From 44eb4da7fe0e32640fb0baa1e91ce753a7cfec19 Mon Sep 17 00:00:00 2001 From: Souf Date: Tue, 28 Apr 2026 17:47:00 +0200 Subject: [PATCH 1/9] Merge branch docs search small model pr (#5) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * docs: add local install for Codex — Node Requirements * feat: add docs search tools and small-model guidance * fix: format generated docs artifacts * fix: standardize search pagination responses --- .github/workflows/ci.yml | 10 +- .gitignore | 1 + README.md | 2 +- docs/client-setup.md | 13 + docs/installation.md | 9 +- scripts/lib/docs.ts | 17 +- scripts/lib/truth.ts | 93 ++- src/generated/docs/api-doc-pages.json | 36 +- src/generated/docs/companion-doc-pages.json | 561 ++++++++++++++----- src/generated/docs/doc-versions.json | 11 +- src/generated/docs/product-doc-pages.json | 74 ++- src/resources/knowledge/query_languages.md | 67 +++ src/tools/discovery-events.ts | 39 +- src/tools/helpers.ts | 68 ++- src/tools/lifecycle.ts | 138 +++-- tests/e2e/docs.test.ts | 6 +- tests/e2e/horizon.test.ts | 25 +- tests/unit/__snapshots__/golden.test.ts.snap | 10 +- tests/unit/docs.test.ts | 2 +- tests/unit/helpers.test.ts | 177 ++++++ tests/unit/tools-v11.test.ts | 81 +++ tests/unit/tools.test.ts | 283 +++++++++- tests/unit/truth.test.ts | 76 +++ tests/unit/workflows.test.ts | 17 + 24 files changed, 1530 insertions(+), 286 deletions(-) create mode 100644 tests/unit/workflows.test.ts diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 87efc86..30207d3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,6 +45,10 @@ jobs: validate: name: Validate runs-on: runs-on=${{ github.run_id }}/runner=evertrust + env: + HORIZON_E2E_URL: ${{ secrets.HORIZON_E2E_URL }} + HORIZON_E2E_API_ID: ${{ secrets.HORIZON_E2E_API_ID }} + HORIZON_E2E_API_KEY: ${{ secrets.HORIZON_E2E_API_KEY }} steps: - name: Configure Runs-On uses: runs-on/action@v2 @@ -84,9 +88,5 @@ jobs: run: bun run test:scenarios - name: QA E2E smoke - if: ${{ secrets.HORIZON_E2E_URL != '' && secrets.HORIZON_E2E_API_ID != '' && secrets.HORIZON_E2E_API_KEY != '' }} - env: - HORIZON_E2E_URL: ${{ secrets.HORIZON_E2E_URL }} - HORIZON_E2E_API_ID: ${{ secrets.HORIZON_E2E_API_ID }} - HORIZON_E2E_API_KEY: ${{ secrets.HORIZON_E2E_API_KEY }} + if: ${{ env.HORIZON_E2E_URL != '' && env.HORIZON_E2E_API_ID != '' && env.HORIZON_E2E_API_KEY != '' }} run: bun run test:e2e:smoke diff --git a/.gitignore b/.gitignore index 53450c8..d5d1681 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ htmlcov/ .playwright-mcp/ audit/ .playwright-cli/ +output/ diff --git a/README.md b/README.md index 7bf353d..175ce9d 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ All mutating tools include a STOP confirmation block that instructs the LLM to a ### Prerequisites -- Bun 1.x+ (recommended) or Node.js 24.10+ +- Bun 1.x+ (recommended) or Node.js >=24.10 - An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9) - API credentials or a client certificate with appropriate permissions diff --git a/docs/client-setup.md b/docs/client-setup.md index 3046361..ab48a2d 100644 --- a/docs/client-setup.md +++ b/docs/client-setup.md @@ -146,6 +146,19 @@ HORIZON_API_ID = "your-api-id" HORIZON_API_KEY = "your-api-key" ``` +Or with a local source checkout: + +```toml +[mcp_servers.horizon] +command = "node" +args = ["/absolute/path/to/horizon-mcp/dist/index.js"] + +[mcp_servers.horizon.env] +HORIZON_URL = "https://horizon.example.com" +HORIZON_API_ID = "your-api-id" +HORIZON_API_KEY = "your-api-key" +``` + In the **Codex Desktop app**, you can also add the server through **Settings > MCP** and follow the GUI prompts. Alternatively, add via the CLI: diff --git a/docs/installation.md b/docs/installation.md index 169c165..ca48c26 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -2,7 +2,7 @@ ## Prerequisites -- Bun 1.x+ (or Node.js 20+) +- Bun 1.x+ (recommended) or Node.js >=24.10 - An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9) - API credentials or a client certificate with appropriate permissions @@ -28,6 +28,13 @@ Then run: horizon-mcp-server ``` +### Local install + +```bash +npm install +npm run build +``` + ### Standalone binary Download the pre-built binary for your platform from the [releases page](https://github.com/evertrust/horizon-mcp/releases), then: diff --git a/scripts/lib/docs.ts b/scripts/lib/docs.ts index 0dd8001..a7ed14c 100644 --- a/scripts/lib/docs.ts +++ b/scripts/lib/docs.ts @@ -1,6 +1,7 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'; import { join, resolve } from 'node:path'; import vm from 'node:vm'; +import { format } from 'prettier'; import type { DocPage, @@ -311,9 +312,10 @@ function buildDocVersionCatalog( }; } -function writeJson(path: string, data: unknown): void { +async function writeJson(path: string, data: unknown): Promise { mkdirSync(resolve(path, '..'), { recursive: true }); - writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`, 'utf8'); + const json = await format(JSON.stringify(data), { parser: 'json' }); + writeFileSync(path, json, 'utf8'); } function parseSitemapLocs(xml: string): string[] { @@ -683,16 +685,19 @@ export async function buildDocsArtifacts(): Promise<{ export async function writeDocsArtifacts(): Promise { const artifacts = await buildDocsArtifacts(); - writeJson( + await writeJson( join(OUTPUT_DIR, 'product-doc-pages.json'), artifacts.productCatalog, ); - writeJson(join(OUTPUT_DIR, 'api-doc-pages.json'), artifacts.apiCatalog); - writeJson( + await writeJson(join(OUTPUT_DIR, 'api-doc-pages.json'), artifacts.apiCatalog); + await writeJson( join(OUTPUT_DIR, 'companion-doc-pages.json'), artifacts.companionCatalog, ); - writeJson(join(OUTPUT_DIR, 'doc-versions.json'), artifacts.versionCatalog); + await writeJson( + join(OUTPUT_DIR, 'doc-versions.json'), + artifacts.versionCatalog, + ); } function normalizeArtifact(value: unknown): unknown { diff --git a/scripts/lib/truth.ts b/scripts/lib/truth.ts index dd31b75..127b99f 100644 --- a/scripts/lib/truth.ts +++ b/scripts/lib/truth.ts @@ -77,6 +77,12 @@ export interface TruthInputs { outputDir: string; } +interface StoredOperationsDocument { + routes?: unknown; + operations?: unknown; + paths?: Record>; +} + function expandHome(pathValue: string): string { if (!pathValue.startsWith('~/')) { return pathValue; @@ -107,6 +113,7 @@ export function resolveTruthInputs(projectRoot: string): TruthInputs { [ process.env['HORIZON_SOURCE_ROOT'] ?? '', '../horizon', + 'src/generated/docs/horizon-routes.json', '/Users/sbo/Documents/EVERTRUST/horizon', ].filter(Boolean), ); @@ -115,6 +122,7 @@ export function resolveTruthInputs(projectRoot: string): TruthInputs { [ process.env['HORIZON_OPENAPI_PATH'] ?? '', '../evertrust_horizon_openapi.json', + 'src/generated/docs/openapi-operations.json', '/Users/sbo/Downloads/evertrust_horizon_openapi.json', ].filter(Boolean), ); @@ -150,6 +158,55 @@ function readText(path: string): string { return readFileSync(path, 'utf8'); } +function isNormalizedOperation(value: unknown): value is NormalizedOperation { + return ( + Boolean(value) && + typeof value === 'object' && + typeof (value as NormalizedOperation).method === 'string' && + typeof (value as NormalizedOperation).path === 'string' && + typeof (value as NormalizedOperation).sourceFile === 'string' + ); +} + +function sortOperations( + operations: readonly NormalizedOperation[], +): NormalizedOperation[] { + return [...operations].sort((left, right) => { + const pathOrder = left.path.localeCompare(right.path); + if (pathOrder !== 0) { + return pathOrder; + } + const methodOrder = left.method.localeCompare(right.method); + if (methodOrder !== 0) { + return methodOrder; + } + return left.sourceFile.localeCompare(right.sourceFile); + }); +} + +function readStoredOperations( + inputPath: string, + field: 'routes' | 'operations', +): NormalizedOperation[] | undefined { + if (!inputPath.endsWith('.json')) { + return undefined; + } + + const document = JSON.parse(readText(inputPath)) as StoredOperationsDocument; + const operations = document[field]; + if (!Array.isArray(operations)) { + return undefined; + } + + return sortOperations( + operations.filter(isNormalizedOperation).map((operation) => ({ + method: operation.method, + path: normalizeRoutePath(operation.path), + sourceFile: operation.sourceFile, + })), + ); +} + function lineNumberAt( sourceFile: ts.SourceFile, nodeOrIndex: ts.Node | number, @@ -293,6 +350,11 @@ export function collectHorizonOperations( horizonRoot: string, projectRoot = process.cwd(), ): NormalizedOperation[] { + const storedOperations = readStoredOperations(horizonRoot, 'routes'); + if (storedOperations) { + return storedOperations; + } + const operations: NormalizedOperation[] = []; for (const route of parseRootRoutes(horizonRoot)) { @@ -317,26 +379,21 @@ export function collectHorizonOperations( } } - return operations.sort((left, right) => { - const pathOrder = left.path.localeCompare(right.path); - if (pathOrder !== 0) { - return pathOrder; - } - const methodOrder = left.method.localeCompare(right.method); - if (methodOrder !== 0) { - return methodOrder; - } - return left.sourceFile.localeCompare(right.sourceFile); - }); + return sortOperations(operations); } export function collectOpenApiOperations( openApiPath: string, projectRoot = process.cwd(), ): NormalizedOperation[] { - const document = JSON.parse(readText(openApiPath)) as { - paths?: Record>; - }; + const storedOperations = readStoredOperations(openApiPath, 'operations'); + if (storedOperations) { + return storedOperations; + } + + const document = JSON.parse( + readText(openApiPath), + ) as StoredOperationsDocument; const operations: NormalizedOperation[] = []; const paths = document.paths ?? {}; @@ -358,13 +415,7 @@ export function collectOpenApiOperations( } } - return operations.sort((left, right) => { - const pathOrder = left.path.localeCompare(right.path); - if (pathOrder !== 0) { - return pathOrder; - } - return left.method.localeCompare(right.method); - }); + return sortOperations(operations); } export function collectMcpPathReferences( diff --git a/src/generated/docs/api-doc-pages.json b/src/generated/docs/api-doc-pages.json index c98c742..d8dae24 100644 --- a/src/generated/docs/api-doc-pages.json +++ b/src/generated/docs/api-doc-pages.json @@ -1,5 +1,5 @@ { - "generatedAt": "2026-04-14T15:50:18.413Z", + "generatedAt": "2026-04-28T14:21:29.349Z", "pageCount": 1182, "pages": [ { @@ -14594,7 +14594,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -14669,7 +14669,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -14707,7 +14707,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -14745,7 +14745,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -23213,7 +23213,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -23288,7 +23288,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -23326,7 +23326,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -23364,7 +23364,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -26711,7 +26711,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -26746,7 +26746,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", "keywords": [ "import", "configuration", @@ -32686,7 +32686,7 @@ "Register a new execution policy" ], "summary": "Register a new execution policy Register a new execution policy Body required application/json Execution policy to register name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + Array [", - "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", + "content": "Register a new execution policy\n\n Register a new execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to register\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 201\n Execution policy successfully registered\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy already exists\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy already exists\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 201\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-004\"\n ,\n\n \"message\":\n \"Execution Policy already exists\"\n ,\n\n \"title\":\n \"Execution Policy already exists\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-002\n EXECUTION-POLICY-004\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n List the existing execution policies\n Update an existing execution policy", "keywords": [ "register", "new", @@ -32761,7 +32761,7 @@ "Retrieve an existing execution policy" ], "summary": "Retrieve an existing execution policy Retrieve an existing execution policy based on its name Path parameters name string required Responses 200 The execution policy application/json _id string (Internal ID) required Object internal ID name", - "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", + "content": "Retrieve an existing execution policy\n\n Retrieve an existing execution policy based on its name\n\n Path parameters\n\n name\n\n string\n required\n\n Responses\n\n 200\n The execution policy\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions/{name}\n\n 200\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Delete an existing execution policy\n Automation policy", "keywords": [ "retrieve", "an", @@ -32799,7 +32799,7 @@ "List the existing execution policies" ], "summary": "List the existing execution policies List the existing execution policies Responses 200 Execution Policy list application/json Array [ _id string (Internal ID) required Object internal ID name string required description string | null autho", - "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", + "content": "List the existing execution policies\n\n List the existing execution policies\n\n Responses\n\n 200\n Execution Policy list\n\napplication/json\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n 204\n No execution policy defined or insufficient permissions\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n get\n\n /api/v1/automation/executions\n\n 200\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ]\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Automation execution\n Register a new execution policy", "keywords": [ "list", "the", @@ -32837,7 +32837,7 @@ "Update an existing execution policy" ], "summary": "Update an existing execution policy Update an existing execution policy Body required application/json Execution policy to update name string required description string | null authorizedPeriods array of objects | null (ExecutionPeriod) + A", - "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", + "content": "Update an existing execution policy\n\n Update an existing execution policy\n\n Body\n required\n\napplication/json\n\n Execution policy to update\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n Responses\n\n 200\n Execution policy successfully updated\n\napplication/json\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n EXECUTION-POLICY-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Execution Policy\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Execution Policy\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not Found\n\napplication/problem+json\n\n EXECUTION-POLICY-003\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Execution Policy not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Execution Policy not found\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EXECUTION-POLICY-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n put\n\n /api/v1/automation/executions\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"EXECUTION-POLICY-002\"\n ,\n\n \"message\":\n \"Invalid Execution Policy\"\n ,\n\n \"title\":\n \"Invalid Execution Policy\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 404\n ,\n\n \"error\":\n \"EXECUTION-POLICY-003\"\n ,\n\n \"message\":\n \"Execution Policy not found\"\n ,\n\n \"title\":\n \"Execution Policy not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"EXECUTION-POLICY-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n EXECUTION-POLICY-001\n SEC-AUTH-001\n LIC-001\n\n Register a new execution policy\n Delete an existing execution policy", "keywords": [ "update", "an", @@ -36209,7 +36209,7 @@ "Export configuration items" ], "summary": "Export configuration items Export configuration items Body required application/json Items to export cas array of object | null (HorizonExportableItemsSeq) + Array [ name string required displayName array of objects | null (LocalizedString)", - "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", + "content": "Export configuration items\n\n Export configuration items\n\n Body\n required\n\napplication/json\n\n Items to export\n\n cas\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiQueues\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n pkiConnectors\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n roles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n teams\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n passwordPolicies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n scimProfiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n notifications\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n datasources\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n discoveryCampaigns\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n thirdParties\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n reports\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n triggers\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n automations\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n executions\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n profiles\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n forestMappings\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n labels\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n proxies\n\n array of object | null (HorizonExportableItemsSeq)\n +\n\n Array [\n\n name\n\n string\n required\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n detail\n\n string | null\n\n ]\n\n Responses\n\n 200\n The exported items\n\napplication/json\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-EXPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid export request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid export request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-EXPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/export\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"detail\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-EXPORT-002\"\n ,\n\n \"message\":\n \"Invalid export request\"\n ,\n\n \"title\":\n \"Invalid export request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-EXPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-EXPORT-001\n SEC-AUTH-001\n LIC-001\n\n List exportable configuration items\n Import configuration items", "keywords": [ "export", "configuration", @@ -36244,7 +36244,7 @@ "Import configuration items" ], "summary": "Import configuration items Import configuration items Body required application/json Items to import info object + createdAt string version string items object (Horizon Exportable Items) + cas array of objects (Certificate Authority) + Arra", - "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-13\"\n ,\n\n \"end\":\n \"2026-04-13\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", + "content": "Import configuration items\n\n Import configuration items\n\n Body\n required\n\napplication/json\n\n Items to import\n\n info\n\n object\n +\n\n createdAt\n\n string\n\n version\n\n string\n\n items\n\n object (Horizon Exportable Items)\n +\n\n cas\n\n array of objects (Certificate Authority)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n certificate\n\n string\n required\n\n name\n\n string\n required\n\n trustedForClientAuthentication\n\n boolean\n required\n\n trustedForServerAuthentication\n\n boolean\n required\n\n outdatedRevocationStatusPolicy\n\n string\n required\n\n Enum\n revoked\n unknown\n lastavailablestatus\n\n public\n\n boolean\n required\n\n subjectKeyIdentifier\n\n string | null\n\n responderUrl\n\n string | null\n\n crlUrl\n\n string | null\n\n refresh\n\n string | null (FiniteDuration)\n\n timeout\n\n string | null (FiniteDuration)\n\n proxy\n\n string | null\n\n cacheTimeToIdle\n\n string | null (FiniteDuration)\n\n downloadable\n\n boolean\n\n ]\n\n pkiQueues\n\n array of objects (PKIQueueResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n clusterWide\n\n boolean\n required\n\n size\n\n integer\n required\n\n description\n\n string | null\n\n throttleDuration\n\n string | null\n\n throttleParallelism\n\n integer | null\n\n ]\n\n pkiConnectors\n\n array of objects (PKIResponses)\n\n roles\n\n array of objects (Role)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the role\n\n description\n\n string | null\n\n The description of the role\n\n permissions\n\n array of objects | null (Permission)\n +\n\n The role's permissions\n\n Array [\n\n value\n\n string\n required\n\n The permission string, in the Horizon format : : : :\n\n filter\n\n string | null\n\n The filter to apply to the permission in the HPQL format\n\n ]\n\n ]\n\n teams\n\n array of objects (Team)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the team\n\n managers\n\n array of string\n required\n\n The identifiers of the team's managers\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n The localized description of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n contact\n\n string | null\n\n The generic contact e-mail of the Team\n\n webhook\n\n object | null (Webhook Definition)\n +\n\n The webhook of the team's corporate channel (Teams, Slack, Mattermost)\n\n type\n\n string\n required\n\n The type of the webhook (Teams or Slack/Mattermost)\n\n Enum\n slack\n teams\n\n url\n\n string\n required\n\n The URL of the webhook\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n The localized display name of the team\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n passwordPolicies\n\n array of objects (Password Policy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n The internal ID of the password policy\n\n name\n\n string\n required\n\n The name of the password policy\n\n minChar\n\n integer\n required\n\n The minimum number of characters of the password\n\n maxChar\n\n integer | null\n\n The maximum number of characters of the password\n\n minUpChar\n\n integer | null\n\n The minimum number of uppercase characters of the password\n\n minLoChar\n\n integer | null\n\n The minimum number of lowercase characters of the password\n\n minDiChar\n\n integer | null\n\n The minimum number of digits of the password\n\n spChar\n\n string | null\n\n The special characters of the password accepted by the password policy\n\n minSpChar\n\n integer | null\n\n The minimum number of special characters of the password\n\n ]\n\n scimProfiles\n\n array of objects (Scim profile)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the Scim profile\n\n description\n\n string | null\n\n The description of the Scim profile\n\n mailType\n\n string | null\n\n The mail type corresponds to the mail coming from the scim provider that must be synchronised in horizon. By default, the mail type is \"work\".\n\n mappings\n\n array of objects | null\n\n The mapping used to synchronize user and group between the scim provider and Horizon.\n\n ]\n\n notifications\n\n array of objects\n\n datasources\n\n array of objects\n\n discoveryCampaigns\n\n array of objects (DiscoveryCampaignResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n The name of the discovery campaign\n\n authorizationLevels\n\n object (DiscoveryCampaignAuthorizationLevels)\n required +\n\n The authorization levels of the discovery campaign\n\n search\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to search the discovered certificates of this campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n feed\n\n object (AuthorizationLevel)\n required +\n\n The authorization level required to feed certificates into this discovery campaign\n\n accessLevel\n\n string\n required\n\n The access level required to perform the action\n\n Enum\n everyone\n authenticated\n authorized\n\n enforcedIdentityProviders\n\n array of objects | null (Enforced identity providers)\n +\n\n The different identity providers that can be enforced to perform the action\n\n Array [\n\n type\n\n string\n required\n\n The type of identity provider to be enforced\n\n Enum\n Local\n OpenId\n X509\n Pop\n\n name\n\n string\n required\n\n The name of the identity provider to be enforced\n\n ]\n\n eventOnSuccess\n\n boolean\n required\n\n Whether to log a Horizon event in case of success\n\n eventOnWarning\n\n boolean\n required\n\n Whether to log a Horizon event in case of warning\n\n eventOnFailure\n\n boolean\n required\n\n Whether to log a Horizon event in case of failure\n\n enabled\n\n boolean\n required\n\n Whether the discovery campaign is enabled, i.e. whether it can be fed\n\n description\n\n string | null\n\n The description of the discovery campaign\n\n hosts\n\n array of string | null\n\n The hosts to be scanned by the discovery campaign\n\n ports\n\n array of string | null\n\n The ports to be scanned by the discovery campaign\n\n gradingPolicies\n\n array of string | null\n\n The grading policies to apply to grade the discovered certificates on this campaign\n\n ]\n\n thirdParties\n\n array of objects (ThirdPartyConnectorResponses)\n\n reports\n\n array of objects (ReportScheduledTaskResponse)\n\n triggers\n\n array of objects\n\n automations\n\n array of objects (AutomationPolicyResponse)\n +\n\n Array [\n\n name\n\n string\n required\n\n _id\n\n string (Internal ID)\n\n Object internal ID\n\n executionPolicy\n\n string | null\n\n compliancePolicy\n\n object | null (CompliancePolicy)\n +\n\n authorizedSigningAlgorithms\n\n array of string | null\n\n authorizedCas\n\n array of string | null\n\n trustChains\n\n array of string | null\n\n profile\n\n string\n\n ]\n\n executions\n\n array of objects (ExecutionPolicyResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n description\n\n string | null\n\n authorizedPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n forbiddenPeriods\n\n array of objects | null (ExecutionPeriod)\n +\n\n Array [\n\n dateRange\n\n object | null (DateRange)\n +\n\n start\n\n string\n required\n\n end\n\n string\n required\n\n weeks\n\n array of integer | null\n\n weekDays\n\n array of string | null\n\n timeRange\n\n string | null\n\n ]\n\n ]\n\n profiles\n\n array of objects (CertificateProfileResponses)\n\n forestMappings\n\n array of objects (WcceForestMappingResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n forest\n\n string\n required\n\n templateMappings\n\n array of objects (WcceTemplateMapping)\n required +\n\n Array [\n\n template\n\n string\n required\n\n profile\n\n string\n required\n\n enrollmentMode\n\n string\n required\n\n Enum\n entity\n eobo\n trust_request\n\n eoboTrustedCas\n\n array of string | null\n\n templateVersion\n\n string\n\n The version of the Microsoft template. Available from 2.8.1\n\n Enum\n v1\n v2\n\n ]\n\n ]\n\n labels\n\n array of objects (LabelResponse)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Technical name of the label\n\n displayName\n\n array of objects | null (LocalizedString)\n +\n\n Display names of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n description\n\n array of objects | null (LocalizedString)\n +\n\n Localized descriptions of the label\n\n Array [\n\n lang\n\n string\n required\n\n The ISO 3166-1 (2-letters) code of the language used for the value\n\n value\n\n string\n required\n\n The localized value\n\n ]\n\n ]\n\n proxies\n\n array of objects (Proxy)\n +\n\n Array [\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n name\n\n string\n required\n\n Name of the proxy\n\n host\n\n string\n required\n\n Hostname of the proxy\n\n port\n\n integer\n required\n\n Port of the proxy\n\n credentials\n\n string | null\n\n Name of the password credentials to use for Proxy Basic Authentication\n\n ]\n\n Responses\n\n 200\n The imported items\n\napplication/json\n\n cas\n\n array of string\n\n pkiQueues\n\n array of string\n\n pkiConnectors\n\n array of string\n\n roles\n\n array of string\n\n teams\n\n array of string\n\n passwordPolicies\n\n array of string\n\n scimProfiles\n\n array of string\n\n notifications\n\n array of string\n\n datasources\n\n array of string\n\n discoveryCampaigns\n\n array of string\n\n thirdParties\n\n array of string\n\n reports\n\n array of string\n\n triggers\n\n array of string\n\n automations\n\n array of string\n\n executions\n\n array of string\n\n profiles\n\n array of string\n\n forestMappings\n\n array of string\n\n labels\n\n array of string\n\n proxies\n\n array of string\n\n 400\n Bad Request\n\napplication/problem+json\n\n CONF-IMPORT-002\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid import\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid import\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal Server error\n\napplication/problem+json\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CONF-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected error\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/system/configurations/import\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"info\":\n\n +\n\n {\n\n \"createdAt\":\n \"string\"\n ,\n\n \"version\":\n \"string\"\n\n ...\n }\n ,\n\n \"items\":\n\n +\n\n {\n\n \"cas\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificate\":\n \"string\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"subjectKeyIdentifier\":\n \"string\"\n ,\n\n \"responderUrl\":\n \"string\"\n ,\n\n \"crlUrl\":\n \"string\"\n ,\n\n \"refresh\":\n \"string\"\n ,\n\n \"trustedForClientAuthentication\":\n true\n ,\n\n \"trustedForServerAuthentication\":\n true\n ,\n\n \"outdatedRevocationStatusPolicy\":\n \"revoked\"\n ,\n\n \"timeout\":\n \"string\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"cacheTimeToIdle\":\n \"string\"\n ,\n\n \"public\":\n true\n ,\n\n \"downloadable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"throttleParallelism\":\n 0\n ,\n\n \"clusterWide\":\n true\n ,\n\n \"size\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"stream\"\n ,\n\n \"endPoint\":\n \"string\"\n ,\n\n \"template\":\n \"string\"\n ,\n\n \"ca\":\n \"string\"\n ,\n\n \"loginCredentials\":\n \"myPasswordCredentials\"\n ,\n\n \"authenticationCredentials\":\n \"myCertificateCredentials\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"queue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"CanEnroll\"\n ,\n\n \"description\":\n \"Gives all enroll permissions to users\"\n ,\n\n \"permissions\":\n\n +\n\n [\n\n +\n\n {\n\n \"value\":\n \"lifecycle:*:*:enroll\"\n ,\n\n \"filter\":\n \"label.BusinessUnit equals \\\"BU1\\\"\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"PKIOps\"\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"webhook\":\n\n +\n\n {\n\n \"type\":\n \"slack\"\n ,\n\n \"url\":\n \"https://hooks.slack.com/services/\"\n\n ...\n }\n ,\n\n \"managers\":\n\n +\n\n [\n\n \" [email protected] \"\n\n ...\n ]\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"Horizon-Default\"\n ,\n\n \"minChar\":\n 8\n ,\n\n \"maxChar\":\n 24\n ,\n\n \"minUpChar\":\n 1\n ,\n\n \"minLoChar\":\n 1\n ,\n\n \"minDiChar\":\n 1\n ,\n\n \"spChar\":\n \"!@#$%^&*()_+\"\n ,\n\n \"minSpChar\":\n 1\n\n ...\n }\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"OktaScim\"\n ,\n\n \"description\":\n \"The Mapping for the Okta provisioning\"\n ,\n\n \"mailType\":\n \"home\"\n ,\n\n \"mappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"group\":\n \"Devs\"\n ,\n\n \"role\":\n \"Okta-Dev-role\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"email\"\n ,\n\n \"emailTemplate\":\n\n +\n\n {\n\n \"to\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \" [email protected] \"\n ,\n\n \"label\":\n \"BU_ADDRESS\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \" [email protected] \"\n ,\n\n \"title\":\n \"Password recovery\"\n ,\n\n \"body\":\n \"You can reset your Horizon password at https://horizon.evertrust.fr/ui#/reset/{{reset.uuid}}. The link will expire on {{reset.expiration}}.\"\n ,\n\n \"isHtml\":\n false\n\n ...\n }\n ,\n\n \"ifPkcs12\":\n true\n ,\n\n \"attachPemCertificate\":\n true\n ,\n\n \"attachPemBundle\":\n true\n ,\n\n \"attachDerCertificate\":\n true\n ,\n\n \"attachPkcs7\":\n true\n ,\n\n \"attachPkcs7Bundle\":\n true\n ,\n\n \"attachPkcs12\":\n true\n ,\n\n \"name\":\n \"NOTIFICATION_ENROLL\"\n ,\n\n \"retries\":\n 10\n ,\n\n \"runPeriod\":\n \"5 days\"\n ,\n\n \"licenseUsagePercent\":\n 50\n ,\n\n \"events\":\n\n +\n\n [\n\n \"on_enroll\"\n\n ...\n ]\n ,\n\n \"runOnRenewed\":\n null\n\n ...\n }\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"dns\"\n ,\n\n \"name\":\n \"DNS_Datasource\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"Use this datasource to get DNS values...\"\n ,\n\n \"host\":\n \"36.54.12.2\"\n ,\n\n \"port\":\n 68\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"recordTypes\":\n\n +\n\n [\n\n \"a\"\n\n ...\n ]\n ,\n\n \"lookup\":\n \"{{host}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"DiscoveryDMZ01\"\n ,\n\n \"description\":\n \"Discovery campaign that scans the DMZ 01\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"feed\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"eventOnSuccess\":\n false\n ,\n\n \"eventOnWarning\":\n false\n ,\n\n \"eventOnFailure\":\n true\n ,\n\n \"hosts\":\n\n +\n\n [\n\n \"horizon.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"ports\":\n\n +\n\n [\n\n \"443\"\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"Horizon-Grading-Policy\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"type\":\n \"aws\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"throttleDuration\":\n \"5 seconds\"\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"region\":\n \"string\"\n ,\n\n \"credentials\":\n \"myPasswordCredentials\"\n ,\n\n \"resourceGroupName\":\n \"string\"\n ,\n\n \"roleArn\":\n \"string\"\n ,\n\n \"tagKey\":\n \"string\"\n ,\n\n \"tagValue\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"retentionPeriod\":\n \"10s\"\n ,\n\n \"reportType\":\n \"link_email\"\n ,\n\n \"type\":\n \"report\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"fileName\":\n \"string\"\n ,\n\n \"recipients\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"static\"\n ,\n\n \"email\":\n \"string\"\n ,\n\n \"team\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"from\":\n \"string\"\n ,\n\n \"title\":\n \"string\"\n ,\n\n \"body\":\n \"string\"\n ,\n\n \"isHtml\":\n true\n ,\n\n \"hqlType\":\n \"heql\"\n ,\n\n \"hqlQuery\":\n \"string\"\n ,\n\n \"hqlFields\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"hqlSortedBy\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"notBefore\"\n ,\n\n \"order\":\n \"Asc\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"cron\":\n \"string\"\n ,\n\n \"host\":\n \"string\"\n ,\n\n \"status\":\n \"warning\"\n ,\n\n \"lastExecutionDate\":\n 0\n ,\n\n \"lastCompletionDate\":\n 0\n ,\n\n \"detail\":\n \"string\"\n ,\n\n \"executionId\":\n \"string\"\n ,\n\n \"enabled\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"type\":\n \"akv\"\n ,\n\n \"retries\":\n 0\n ,\n\n \"connector\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"executionPolicy\":\n \"string\"\n ,\n\n \"compliancePolicy\":\n\n +\n\n {\n\n \"authorizedSigningAlgorithms\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"authorizedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n ...\n }\n ,\n\n \"trustChains\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profile\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"description\":\n \"string\"\n ,\n\n \"authorizedPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forbiddenPeriods\":\n\n +\n\n [\n\n +\n\n {\n\n \"dateRange\":\n\n +\n\n {\n\n \"start\":\n \"2026-04-27\"\n ,\n\n \"end\":\n \"2026-04-27\"\n\n ...\n }\n ,\n\n \"weeks\":\n\n +\n\n [\n\n 0\n\n ...\n ]\n ,\n\n \"weekDays\":\n\n +\n\n [\n\n \"MONDAY\"\n\n ...\n ]\n ,\n\n \"timeRange\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"module\":\n \"acme\"\n ,\n\n \"name\":\n \"string\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"enabled\":\n true\n ,\n\n \"timeout\":\n \"5 seconds\"\n ,\n\n \"meta\":\n\n +\n\n {\n\n \"termsOfService\":\n \"string\"\n ,\n\n \"website\":\n \"string\"\n ,\n\n \"caaIdentities\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"externalAccountRequired\":\n true\n\n ...\n }\n ,\n\n \"constraints\":\n\n +\n\n {\n\n \"allowedDomains\":\n \"string\"\n ,\n\n \"allowedEmailDomains\":\n \"string\"\n ,\n\n \"allowedDnsDomains\":\n \"string\"\n\n ...\n }\n ,\n\n \"authorizationMethods\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnector\":\n \"string\"\n ,\n\n \"http01Port\":\n 0\n ,\n\n \"tlsAlpn01Port\":\n 0\n ,\n\n \"authorizeShortName\":\n true\n ,\n\n \"authorizeEmptyContact\":\n true\n ,\n\n \"defaultContacts\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"verifyRetryCount\":\n 0\n ,\n\n \"verifyRetryDelay\":\n \"5 seconds\"\n ,\n\n \"requireTermsOfService\":\n true\n ,\n\n \"renewalPeriod\":\n \"5 seconds\"\n ,\n\n \"csrDataMapping\":\n\n +\n\n {\n\n \"additionalProp\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxCertificatePerHolderPolicy\":\n\n +\n\n {\n\n \"max\":\n 0\n ,\n\n \"behavior\":\n \"revoke\"\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"maxDnsName\":\n 0\n ,\n\n \"proxy\":\n \"string\"\n ,\n\n \"authorizationLevels\":\n\n +\n\n {\n\n \"enroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"enrollApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveEnroll\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"revoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRevoke\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"search\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"update\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveUpdate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"recoverApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRecover\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"migrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveMigrate\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"renewApi\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"approveRenew\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"auditRequest\":\n\n +\n\n {\n\n \"accessLevel\":\n \"authenticated\"\n ,\n\n \"enforcedIdentityProviders\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"Local\"\n ,\n\n \"name\":\n \"local\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"triggers\":\n\n +\n\n {\n\n \"onEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyEnroll\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingEnroll\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRevoke\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRevoke\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyUpdate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingUpdate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRecover\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRecover\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyMigrate\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingMigrate\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onExpire\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"onRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onSubmitRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onCancelRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onApproveRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onDenyRenew\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"onPendingRenew\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"string\"\n ,\n\n \"activationDate\":\n 0\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"requestsPolicy\":\n\n +\n\n {\n\n \"enroll\":\n \"5 seconds\"\n ,\n\n \"revoke\":\n \"5 seconds\"\n ,\n\n \"recover\":\n \"5 seconds\"\n ,\n\n \"update\":\n \"5 seconds\"\n ,\n\n \"migrate\":\n \"5 seconds\"\n ,\n\n \"renew\":\n \"5 seconds\"\n\n ...\n }\n ,\n\n \"selfPermissions\":\n\n +\n\n {\n\n \"selfRecover\":\n false\n ,\n\n \"selfUpdate\":\n false\n ,\n\n \"selfRevoke\":\n false\n ,\n\n \"selfRenew\":\n false\n ,\n\n \"selfPopRenew\":\n false\n ,\n\n \"selfPopRevoke\":\n false\n ,\n\n \"selfPopUpdate\":\n false\n\n ...\n }\n ,\n\n \"certificateTemplate\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"string\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"min\":\n 0\n ,\n\n \"max\":\n 0\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"ownerPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"teamPolicy\":\n\n +\n\n {\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"metadataPolicies\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"gs_order_id\"\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"^.*aregex$\"\n ,\n\n \"enum\":\n\n +\n\n [\n\n \"business_unit_1\"\n ,\n\n \"business_unit_2\"\n\n ...\n ]\n ,\n\n \"suggestions\":\n\n +\n\n [\n\n \"business_unit_2\"\n ,\n\n \"business_unit_3\"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmailPolicy\":\n\n +\n\n {\n\n \"value\":\n \"string\"\n ,\n\n \"computationRule\":\n \"{{csr.subject.cn.1}}\"\n ,\n\n \"mandatory\":\n true\n ,\n\n \"editableByRequester\":\n true\n ,\n\n \"editableByApprover\":\n true\n ,\n\n \"regex\":\n \"string\"\n ,\n\n \"whitelist\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n }\n ,\n\n \"cryptoPolicy\":\n\n +\n\n {\n\n \"centralized\":\n false\n ,\n\n \"decentralized\":\n false\n ,\n\n \"defaultKeyType\":\n \"rsa-2048\"\n ,\n\n \"authorizedKeyTypes\":\n\n +\n\n [\n\n \"rsa-2048\"\n ,\n\n \"rsa-3072\"\n ,\n\n \"rsa-4096\"\n\n ...\n ]\n ,\n\n \"preferredEnrollmentMode\":\n \"centralized\"\n ,\n\n \"escrow\":\n false\n ,\n\n \"p12passwordPolicy\":\n \"string\"\n ,\n\n \"p12passwordMode\":\n \"random\"\n ,\n\n \"p12storeEncryptionType\":\n \"AES\"\n ,\n\n \"showP12PasswordOnEnroll\":\n true\n ,\n\n \"showP12OnEnroll\":\n true\n ,\n\n \"showP12PasswordOnRecover\":\n true\n ,\n\n \"showP12OnRecover\":\n true\n ,\n\n \"keyAvailability\":\n \"string\"\n\n ...\n }\n ,\n\n \"gradingPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"dsFlow\":\n\n +\n\n [\n\n +\n\n {\n\n \"ds\":\n \"LDAP_DS\"\n ,\n\n \"inputs\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"LDAP_DS\"\n ,\n\n \"value\":\n \"{{csr.subject.cn.1}}\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"stopOnSuccess\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyDiscoverySync\":\n false\n\n ...\n }\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"forest\":\n \"string\"\n ,\n\n \"templateMappings\":\n\n +\n\n [\n\n +\n\n {\n\n \"template\":\n \"string\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"enrollmentMode\":\n \"entity\"\n ,\n\n \"eoboTrustedCas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"templateVersion\":\n \"v1\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"business_unit\"\n ,\n\n \"displayName\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"description\":\n\n +\n\n [\n\n +\n\n {\n\n \"lang\":\n \"en\"\n ,\n\n \"value\":\n \"Value In English\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"name\":\n \"ExternalProxy\"\n ,\n\n \"host\":\n \"36.52.145.12\"\n ,\n\n \"port\":\n 8888\n ,\n\n \"credentials\":\n \"ProxyCredentials\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n }\n\n 200\n 400\n 401\n 403\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"cas\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiQueues\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"pkiConnectors\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"roles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"teams\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"passwordPolicies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"scimProfiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"notifications\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"datasources\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"discoveryCampaigns\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"thirdParties\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"reports\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"triggers\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"automations\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"executions\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"profiles\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"forestMappings\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n ,\n\n \"proxies\":\n\n +\n\n [\n\n \"string\"\n\n ...\n ]\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"CONF-IMPORT-002\"\n ,\n\n \"message\":\n \"Invalid import\"\n ,\n\n \"title\":\n \"Invalid import\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 401\n ,\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-AUTH-001\n SEC-AUTH-002\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 403\n ,\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n SEC-PERM-001\n LIC-002\n LIC-004\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"CONF-IMPORT-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"SEC-AUTH-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 500\n ,\n\n \"error\":\n \"LIC-001\"\n ,\n\n \"message\":\n \"Unexpected error\"\n ,\n\n \"title\":\n \"Unexpected error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CONF-IMPORT-001\n SEC-AUTH-001\n LIC-001\n\n Export configuration items\n Certificate analytics", "keywords": [ "import", "configuration", @@ -38169,7 +38169,7 @@ "Submit a request" ], "summary": "Submit a request Submit a new request Body required application/json The Request to submit WebRA Enroll Request WebRA Revoke Request WebRA Update Request WebRA Recover Request WebRA Migrate Request WebRA Renew Request WebRA Import Request E", - "content": "Submit a request\n\n Submit a new request\n\n Body\n required\n\napplication/json\n\n The Request to submit\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n profile\n\n string\n required\n\n The WebRA profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n template\n\n object (WebRA Enroll Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n keyType\n\n string | null (Keytype)\n\n The type of key that will be used to generate the certificate, if in centralized mode\n\n csr\n\n string | null\n\n If decentralized enrollment is enabled, this field will contain the CSR that will be used to generate the certificate\n\n password\n\n object (SecretString)\n +\n\n The password to decrypt the PKCS12 file. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n workflow\n\n string\n required\n\n What this request will do. For a revocation request, this is always revoke\n\n Value\n revoke\n\n template\n\n object (WebRA Revoke Request Template)\n required +\n\n The user-data that will be used to revoke the certificate\n\n revocationReason\n\n string | null (Revocation Reason)\n\n One of: unspecified , keycompromise , cacompromise , affiliationchange , superseded , cessationofoperation\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to revoke\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to revoke\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n workflow\n\n string\n required\n\n What this request will do. For an update request, this is always update\n\n Value\n update\n\n template\n\n object (WebRA Update Request Template)\n required +\n\n The user-data that will be used to update the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Information about the certificate's labels and how to edit them\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Information about the certificate's metadata and how to edit them\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to update\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to update\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n workflow\n\n object\n required\n\n What this request will do. For a recovery request, this is always recover\n\n Value\n recover\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to renew\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to renew\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n profile\n\n string\n required\n\n The target profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For a migration request, this is always migrate\n\n Value\n migrate\n\n template\n\n object (WebRA Migrate Request Template)\n required +\n\n The user-data that will be used to migrate the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n value\n\n string | null\n\n The contact email\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to renew\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to renew\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in a migration\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n object\n required\n\n What this request will do. For a renewal request, this is always renew\n\n Value\n renew\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to renew\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to renew\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (WebRA Renew Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n csr\n\n string | null\n\n The CSR used to renew the certificate, if in decentralized mode\n\n keyType\n\n string | null (Keytype)\n\n The key type of the certificate, if in centralized mode\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n object\n required\n\n What this request will do. For an import request, this is always import\n\n Value\n import\n\n profile\n\n string | null\n\n The profile name on which to import\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to import\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to import\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (WebRA Import Request Template)\n +\n\n The user-data that will be added on certificate import\n\n owner\n\n object | null (Certificate Owner)\n +\n\n The owner for this certificate\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n The team for this certificate\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n The contact email for this certificate\n\n value\n\n string | null\n\n The contact email\n\n labels\n\n array of objects | null (Label)\n +\n\n The labels for this certificate\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The third party data associated with the certificate\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n discoveryInfo\n\n object | null (DiscoveryInfo)\n +\n\n Information about the discovery of this certificate\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n discoveryData\n\n object (HostDiscoveryData)\n +\n\n The host discovery data associated with the certificate (discovery metadata)\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n privateKey\n\n string | null\n\n The PEM-encoded private key associated with the certificate. Mandatory if target profile has escrow enabled, forbidden otherwise\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n profile\n\n string\n required\n\n The EST profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For an EST request, this is always est\n\n Value\n est\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n dn\n\n object\n\n Fill the DN if DN whitelist is enabled. Contains the DN of the challenge\n\n password\n\n object | null (SecretString)\n +\n\n The password of the challenge. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (EST Enroll Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n profile\n\n object\n required\n\n The SCEP profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a SCEP request, this is always scep\n\n Value\n scep\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n dn\n\n object\n\n Fill the DN if DN whitelist is enabled. Contains the DN of the challenge\n\n password\n\n object (SecretString)\n +\n\n The password of the challenge. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (SCEP Enroll Request Template)\n +\n\n The user-data that will be used to generate the challenge\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n Responses\n\n 201\n Request successfully submitted\n\napplication/json\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n template\n\n object (WebRA Enroll Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n keyType\n\n string | null (Keytype)\n\n The type of key that will be used to generate the certificate, if in centralized mode\n\n csr\n\n string | null\n\n If decentralized enrollment is enabled, this field will contain the CSR that will be used to generate the certificate\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n pkcs12\n\n object | null (SecretString)\n +\n\n The generated PKCS#12 for this request. This is only available after the request has been approved in centralized mode\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was generated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate revoked.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For a revocation request, this is always revoke\n\n Value\n revoke\n\n template\n\n object (WebRA Revoke Request Template)\n required +\n\n The user-data that was used to revoke the certificate\n\n revocationReason\n\n string | null (Revocation Reason)\n\n One of: unspecified , keycompromise , cacompromise , affiliationchange , superseded , cessationofoperation\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was revoked for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate updated.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For an update request, this is always update\n\n Value\n update\n\n template\n\n object (WebRA Update Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Information about the certificate's labels and how to edit them\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Information about the certificate's metadata and how to edit them\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was updated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate recovered.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For a recovery request, this is always recover\n\n Value\n recover\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n pkcs12\n\n object | null (SecretString)\n +\n\n The generated PKCS#12 for this request. This is only available after the request has been approved.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was recovered.\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate migrated.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For a migration request, this is always migrate\n\n Value\n migrate\n\n profile\n\n string\n required\n\n The target profile name\n\n template\n\n object (WebRA Migrate Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n value\n\n string | null\n\n The contact email\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was updated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in a migration\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For a renewal request, this is always renew\n\n Value\n renew\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n template\n\n object (WebRA Renew Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n csr\n\n string | null\n\n The CSR used to renew the certificate, if in decentralized mode\n\n keyType\n\n string | null (Keytype)\n\n The key type of the certificate, if in centralized mode\n\n pkcs12\n\n object | null (SecretString)\n +\n\n The generated PKCS#12 for this request. This is only available after the request has been approved in centralized mode\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was generated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate imported.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For an import request, this is always import\n\n Value\n import\n\n certificate\n\n object | null (Certificate)\n required +\n\n The certificate that was generated for this request.\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n template\n\n object (WebRA Import Request Template)\n +\n\n The user-data that will be added on certificate import\n\n owner\n\n object | null (Certificate Owner)\n +\n\n The owner for this certificate\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n The team for this certificate\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n The contact email for this certificate\n\n value\n\n string | null\n\n The contact email\n\n labels\n\n array of objects | null (Label)\n +\n\n The labels for this certificate\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The third party data associated with the certificate\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n discoveryInfo\n\n object | null (DiscoveryInfo)\n +\n\n Information about the discovery of this certificate\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n discoveryData\n\n object (HostDiscoveryData)\n +\n\n The host discovery data associated with the certificate (discovery metadata)\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n privateKey\n\n string | null\n\n The PEM-encoded private key associated with the certificate. Mandatory if target profile has escrow enabled, forbidden otherwise\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an import\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n module\n\n string\n required\n\n The module that will be used to process this request. For an EST request, this is always est\n\n Value\n est\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n dn\n\n string\n\n The DN of the challenge\n\n template\n\n object (EST Enroll Request Template)\n +\n\n The user-data that will be used to generate the challenge\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n password\n\n object | null (SecretString)\n +\n\n The password of the challenge.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n holderId\n\n string (Holder ID)\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a SCEP request, this is always scep\n\n Value\n scep\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n dn\n\n string\n\n The DN of the challenge\n\n template\n\n object (SCEP Enroll Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n password\n\n object | null (SecretString)\n +\n\n The password of the challenge. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n holderId\n\n string (Holder ID)\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n 400\n Invalid request\n\napplication/problem+json\n\n CERT-TEAM-001\n CERT-ELEM-001\n REQ-002\n REQ-004\n REQ-005\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-010\n EST-ENROLL-001\n EST-ENROLL-002\n EST-ENROLL-003\n EST-ENROLL-004\n EST-ENROLL-005\n SCEP-ENROLL-001\n SCEP-ENROLL-002\n SCEP-ENROLL-003\n SCEP-ENROLL-004\n SCEP-ENROLL-005\n WEBRA-ENROLL-001\n WEBRA-ENROLL-002\n WEBRA-ENROLL-003\n WEBRA-ENROLL-004\n WEBRA-ENROLL-005\n WEBRA-ENROLL-006\n WEBRA-ENROLL-009\n WEBRA-ENROLL-012\n WEBRA-RECOVER-001\n WEBRA-RECOVER-002\n WEBRA-RECOVER-003\n WEBRA-RECOVER-004\n WEBRA-REVOKE-001\n WEBRA-REVOKE-003\n WEBRA-REVOKE-004\n WEBRA-REVOKE-005\n WEBRA-REVOKE-006\n WEBRA-MIGRATE-001\n WEBRA-MIGRATE-007\n WEBRA-RENEW-001\n WEBRA-RENEW-003\n WEBRA-RENEW-004\n WEBRA-RENEW-005\n WEBRA-RENEW-006\n WEBRA-IMPORT-001\n WEBRA-IMPORT-003\n WEBRA-IMPORT-004\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CERT-TEAM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Team Element\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Team Element\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CERT-ELEM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Certificate Element\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Certificate Element\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Request status\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Request status\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Jwt Token\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Jwt Token\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Authorization Mode as DN whitelisting is not enabled on profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Authorization Mode as DN whitelisting is not enabled on profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DN is required as DN whitelisting is enabled on EST profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DN is required as DN whitelisting is enabled on EST profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Distinguished Name\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Distinguished Name\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid EST Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid EST Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid EST Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid EST Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n SCEP pre-validation is not enabled on SCEP profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n SCEP pre-validation is not enabled on SCEP profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DN is required as DN whitelisting is enabled on SCEP profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DN is required as DN whitelisting is enabled on SCEP profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Distinguished Name\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Distinguished Name\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid SCEP Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid SCEP Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid SCEP Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid SCEP Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid enrollment mode\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid enrollment mode\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid key type\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid key type\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid certificate request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid certificate request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid subject parameter(s)\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid subject parameter(s)\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid subject alternate name parameter(s)\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid subject alternate name parameter(s)\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid label parameter(s)\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid label parameter(s)\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Enrollment Request Template on approved request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Enrollment Request Template on approved request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-012\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n No certificateId specified\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n No certificateId specified\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority recovery failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority recovery failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Recover Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Recover Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate does not exist\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n No certificate specified\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n No certificate specified\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority revocation request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority revocation request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate does not exist\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid certificate\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid certificate\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Revoke Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Revoke Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-MIGRATE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n No certificate specified\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n No certificate specified\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-MIGRATE-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid migration profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid migration profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Renewal not enabled on Web Registration Authority Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Renewal not enabled on Web Registration Authority Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate not in its renewal period\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate not in its renewal period\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate status does not allow renewal\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate status does not allow renewal\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-IMPORT-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate key is already escrowed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate key is already escrowed\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-IMPORT-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Import request does not contain certificate\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Import request does not contain certificate\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-009\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n LIC-002\n LIC-003\n LIC-004\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Maximum number of holders reached\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Maximum number of holders reached\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not found\n\napplication/problem+json\n\n REQ-001\n REQ-003\n REQ-009\n REQ-010\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Request not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Request not found\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Certificate\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Certificate\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Profile does not exist or is disabled\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Profile does not exist or is disabled\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal server error\n\napplication/problem+json\n\n REQ-001\n REQ-003\n REQ-010\n EST-ENROLL-006\n EST-ENROLL-007\n EST-ENROLL-008\n EST-ENROLL-009\n SCEP-ENROLL-006\n SCEP-ENROLL-007\n SCEP-ENROLL-008\n SCEP-ENROLL-009\n WEBRA-ENROLL-007\n WEBRA-ENROLL-008\n WEBRA-ENROLL-010\n WEBRA-ENROLL-011\n WEBRA-ENROLL-012\n WEBRA-ENROLL-013\n WEBRA-ENROLL-014\n WEBRA-RECOVER-002\n WEBRA-REVOKE-002\n WEBRA-MIGRATE-005\n WEBRA-RENEW-002\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Request not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Request not found\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Profile does not exist or is disabled\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Profile does not exist or is disabled\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing profile EST Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing profile EST Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing approved EST Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing approved EST Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing pending EST Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing pending EST Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing profile SCEP Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing profile SCEP Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing approved SCEP Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing approved SCEP Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing pending SCEP Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing pending SCEP Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Enrollment Request Template on profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Enrollment Request Template on profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Enrollment Request Template on pending request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Enrollment Request Template on pending request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-011\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority enrollment failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority enrollment failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-012\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-013\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-014\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority recovery failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority recovery failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority revocation failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority revocation failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-MIGRATE-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Migrate Request Template on submitted request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Migrate Request Template on submitted request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority renewal failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority renewal failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/requests/submit\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"workflow\":\n \"revoke\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"workflow\":\n \"update\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"workflow\":\n\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"migrate\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n\n ,\n\n \"template\":\n\n +\n\n {\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n ,\n\n \"keyType\":\n \"rsa-2048\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n\n ,\n\n \"template\":\n\n +\n\n {\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n ,\n\n \"discoveryData\":\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"privateKey\":\n \"-----BEGIN PRIVATE KEY-----...\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"dn\":\n\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"est\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n\n ,\n\n \"dn\":\n\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"scep\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n 201\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n\n ...\n }\n ,\n\n \"pkcs12\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"revoke\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"update\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"recover\"\n ,\n\n \"pkcs12\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"migrate\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"renew\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n ,\n\n \"keyType\":\n \"rsa-2048\"\n\n ...\n }\n ,\n\n \"pkcs12\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"import\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n ,\n\n \"discoveryData\":\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"privateKey\":\n \"-----BEGIN PRIVATE KEY-----...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"est\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"dn\":\n \"CN=test,O=EVERTRUST\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"scep\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"dn\":\n \"CN=test,O=EVERTRUST\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n Copy\n\n {\n\n \"error\":\n \"CERT-TEAM-001\"\n ,\n\n \"message\":\n \"Invalid Team Element\"\n ,\n\n \"title\":\n \"Invalid Team Element\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"CERT-ELEM-001\"\n ,\n\n \"message\":\n \"Invalid Certificate Element\"\n ,\n\n \"title\":\n \"Invalid Certificate Element\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-002\"\n ,\n\n \"message\":\n \"Invalid Request\"\n ,\n\n \"title\":\n \"Invalid Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-004\"\n ,\n\n \"message\":\n \"Invalid Request status\"\n ,\n\n \"title\":\n \"Invalid Request status\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-005\"\n ,\n\n \"message\":\n \"Expired Request\"\n ,\n\n \"title\":\n \"Expired Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-010\"\n ,\n\n \"message\":\n \"Invalid Jwt Token\"\n ,\n\n \"title\":\n \"Invalid Jwt Token\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-001\"\n ,\n\n \"message\":\n \"Invalid Authorization Mode as DN whitelisting is not enabled on profile\"\n ,\n\n \"title\":\n \"Invalid Authorization Mode as DN whitelisting is not enabled on profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-002\"\n ,\n\n \"message\":\n \"DN is required as DN whitelisting is enabled on EST profile\"\n ,\n\n \"title\":\n \"DN is required as DN whitelisting is enabled on EST profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-003\"\n ,\n\n \"message\":\n \"Invalid Distinguished Name\"\n ,\n\n \"title\":\n \"Invalid Distinguished Name\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-004\"\n ,\n\n \"message\":\n \"Invalid EST Enroll Request\"\n ,\n\n \"title\":\n \"Invalid EST Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-005\"\n ,\n\n \"message\":\n \"Invalid EST Profile\"\n ,\n\n \"title\":\n \"Invalid EST Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-001\"\n ,\n\n \"message\":\n \"SCEP pre-validation is not enabled on SCEP profile\"\n ,\n\n \"title\":\n \"SCEP pre-validation is not enabled on SCEP profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-002\"\n ,\n\n \"message\":\n \"DN is required as DN whitelisting is enabled on SCEP profile\"\n ,\n\n \"title\":\n \"DN is required as DN whitelisting is enabled on SCEP profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-003\"\n ,\n\n \"message\":\n \"Invalid Distinguished Name\"\n ,\n\n \"title\":\n \"Invalid Distinguished Name\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-004\"\n ,\n\n \"message\":\n \"Invalid SCEP Enroll Request\"\n ,\n\n \"title\":\n \"Invalid SCEP Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-005\"\n ,\n\n \"message\":\n \"Invalid SCEP Profile\"\n ,\n\n \"title\":\n \"Invalid SCEP Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-001\"\n ,\n\n \"message\":\n \"Invalid enrollment mode\"\n ,\n\n \"title\":\n \"Invalid enrollment mode\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-002\"\n ,\n\n \"message\":\n \"Invalid key type\"\n ,\n\n \"title\":\n \"Invalid key type\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-003\"\n ,\n\n \"message\":\n \"Invalid certificate request\"\n ,\n\n \"title\":\n \"Invalid certificate request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-004\"\n ,\n\n \"message\":\n \"Invalid subject parameter(s)\"\n ,\n\n \"title\":\n \"Invalid subject parameter(s)\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-005\"\n ,\n\n \"message\":\n \"Invalid subject alternate name parameter(s)\"\n ,\n\n \"title\":\n \"Invalid subject alternate name parameter(s)\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-006\"\n ,\n\n \"message\":\n \"Invalid label parameter(s)\"\n ,\n\n \"title\":\n \"Invalid label parameter(s)\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-009\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Enrollment Request Template on approved request\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Enrollment Request Template on approved request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-012\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-001\"\n ,\n\n \"message\":\n \"No certificateId specified\"\n ,\n\n \"title\":\n \"No certificateId specified\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-002\"\n ,\n\n \"message\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"title\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-003\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Recover Request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Recover Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-004\"\n ,\n\n \"message\":\n \"Certificate does not exist\"\n ,\n\n \"title\":\n \"Certificate does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-001\"\n ,\n\n \"message\":\n \"No certificate specified\"\n ,\n\n \"title\":\n \"No certificate specified\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-003\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority revocation request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority revocation request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-004\"\n ,\n\n \"message\":\n \"Certificate does not exist\"\n ,\n\n \"title\":\n \"Certificate does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-005\"\n ,\n\n \"message\":\n \"Invalid certificate\"\n ,\n\n \"title\":\n \"Invalid certificate\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-006\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Revoke Request Template\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Revoke Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-MIGRATE-001\"\n ,\n\n \"message\":\n \"No certificate specified\"\n ,\n\n \"title\":\n \"No certificate specified\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-MIGRATE-007\"\n ,\n\n \"message\":\n \"Invalid migration profile\"\n ,\n\n \"title\":\n \"Invalid migration profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-001\"\n ,\n\n \"message\":\n \"Invalid request\"\n ,\n\n \"title\":\n \"Invalid request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-003\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-004\"\n ,\n\n \"message\":\n \"Renewal not enabled on Web Registration Authority Profile\"\n ,\n\n \"title\":\n \"Renewal not enabled on Web Registration Authority Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-005\"\n ,\n\n \"message\":\n \"Certificate not in its renewal period\"\n ,\n\n \"title\":\n \"Certificate not in its renewal period\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-006\"\n ,\n\n \"message\":\n \"Certificate status does not allow renewal\"\n ,\n\n \"title\":\n \"Certificate status does not allow renewal\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"WEBRA-IMPORT-001\"\n ,\n\n \"message\":\n \"Invalid request\"\n ,\n\n \"title\":\n \"Invalid request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"WEBRA-IMPORT-003\"\n ,\n\n \"message\":\n \"Certificate key is already escrowed\"\n ,\n\n \"title\":\n \"Certificate key is already escrowed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"WEBRA-IMPORT-004\"\n ,\n\n \"message\":\n \"Import request does not contain certificate\"\n ,\n\n \"title\":\n \"Import request does not contain certificate\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CERT-TEAM-001\n CERT-ELEM-001\n REQ-002\n REQ-004\n REQ-005\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-010\n EST-ENROLL-001\n EST-ENROLL-002\n EST-ENROLL-003\n EST-ENROLL-004\n EST-ENROLL-005\n SCEP-ENROLL-001\n SCEP-ENROLL-002\n SCEP-ENROLL-003\n SCEP-ENROLL-004\n SCEP-ENROLL-005\n WEBRA-ENROLL-001\n WEBRA-ENROLL-002\n WEBRA-ENROLL-003\n WEBRA-ENROLL-004\n WEBRA-ENROLL-005\n WEBRA-ENROLL-006\n WEBRA-ENROLL-009\n WEBRA-ENROLL-012\n WEBRA-RECOVER-001\n WEBRA-RECOVER-002\n WEBRA-RECOVER-003\n WEBRA-RECOVER-004\n WEBRA-REVOKE-001\n WEBRA-REVOKE-003\n WEBRA-REVOKE-004\n WEBRA-REVOKE-005\n WEBRA-REVOKE-006\n WEBRA-MIGRATE-001\n WEBRA-MIGRATE-007\n WEBRA-RENEW-001\n WEBRA-RENEW-003\n WEBRA-RENEW-004\n WEBRA-RENEW-005\n WEBRA-RENEW-006\n WEBRA-IMPORT-001\n WEBRA-IMPORT-003\n WEBRA-IMPORT-004\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 401\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 401\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"LIC-003\"\n ,\n\n \"message\":\n \"Maximum number of holders reached\"\n ,\n\n \"title\":\n \"Maximum number of holders reached\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n SEC-PERM-001\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n LIC-002\n LIC-003\n LIC-004\n\n Copy\n\n {\n\n \"error\":\n \"REQ-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-003\"\n ,\n\n \"message\":\n \"Request not found\"\n ,\n\n \"title\":\n \"Request not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-009\"\n ,\n\n \"message\":\n \"Invalid Certificate\"\n ,\n\n \"title\":\n \"Invalid Certificate\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-010\"\n ,\n\n \"message\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"title\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n REQ-001\n REQ-003\n REQ-009\n REQ-010\n\n Copy\n\n {\n\n \"error\":\n \"REQ-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-003\"\n ,\n\n \"message\":\n \"Request not found\"\n ,\n\n \"title\":\n \"Request not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-010\"\n ,\n\n \"message\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"title\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-006\"\n ,\n\n \"message\":\n \"Missing profile EST Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing profile EST Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-007\"\n ,\n\n \"message\":\n \"Missing approved EST Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing approved EST Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-008\"\n ,\n\n \"message\":\n \"Missing pending EST Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing pending EST Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-009\"\n ,\n\n \"message\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"title\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-006\"\n ,\n\n \"message\":\n \"Missing profile SCEP Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing profile SCEP Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-007\"\n ,\n\n \"message\":\n \"Missing approved SCEP Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing approved SCEP Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-008\"\n ,\n\n \"message\":\n \"Missing pending SCEP Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing pending SCEP Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-009\"\n ,\n\n \"message\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"title\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-007\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Enrollment Request Template on profile\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Enrollment Request Template on profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-008\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Enrollment Request Template on pending request\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Enrollment Request Template on pending request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-010\"\n ,\n\n \"message\":\n \"Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\"\n ,\n\n \"title\":\n \"Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-011\"\n ,\n\n \"message\":\n \"Web Registration Authority enrollment failed\"\n ,\n\n \"title\":\n \"Web Registration Authority enrollment failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-012\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-013\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-014\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-002\"\n ,\n\n \"message\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"title\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-002\"\n ,\n\n \"message\":\n \"Web Registration Authority revocation failed\"\n ,\n\n \"title\":\n \"Web Registration Authority revocation failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-MIGRATE-005\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Migrate Request Template on submitted request\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Migrate Request Template on submitted request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-002\"\n ,\n\n \"message\":\n \"Web Registration Authority renewal failed\"\n ,\n\n \"title\":\n \"Web Registration Authority renewal failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n REQ-001\n REQ-003\n REQ-010\n EST-ENROLL-006\n EST-ENROLL-007\n EST-ENROLL-008\n EST-ENROLL-009\n SCEP-ENROLL-006\n SCEP-ENROLL-007\n SCEP-ENROLL-008\n SCEP-ENROLL-009\n WEBRA-ENROLL-007\n WEBRA-ENROLL-008\n WEBRA-ENROLL-010\n WEBRA-ENROLL-011\n WEBRA-ENROLL-012\n WEBRA-ENROLL-013\n WEBRA-ENROLL-014\n WEBRA-RECOVER-002\n WEBRA-REVOKE-002\n WEBRA-MIGRATE-005\n WEBRA-RENEW-002\n\n Retrieve a request template\n Retrieve a request", + "content": "Submit a request\n\n Submit a new request\n\n Body\n required\n\napplication/json\n\n The Request to submit\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n profile\n\n string\n required\n\n The WebRA profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n template\n\n object (WebRA Enroll Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n keyType\n\n string | null (Keytype)\n\n The type of key that will be used to generate the certificate, if in centralized mode\n\n csr\n\n string | null\n\n If decentralized enrollment is enabled, this field will contain the CSR that will be used to generate the certificate\n\n password\n\n object (SecretString)\n +\n\n The password to decrypt the PKCS12 file. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n workflow\n\n string\n required\n\n What this request will do. For a revocation request, this is always revoke\n\n Value\n revoke\n\n template\n\n object (WebRA Revoke Request Template)\n required +\n\n The user-data that will be used to revoke the certificate\n\n revocationReason\n\n string | null (Revocation Reason)\n\n One of: unspecified , keycompromise , cacompromise , affiliationchange , superseded , cessationofoperation\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to revoke\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to revoke\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n workflow\n\n string\n required\n\n What this request will do. For an update request, this is always update\n\n Value\n update\n\n template\n\n object (WebRA Update Request Template)\n required +\n\n The user-data that will be used to update the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Information about the certificate's labels and how to edit them\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Information about the certificate's metadata and how to edit them\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to update\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to update\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n workflow\n\n object\n required\n\n What this request will do. For a recovery request, this is always recover\n\n Value\n recover\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to renew\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to renew\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n profile\n\n string\n required\n\n The target profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For a migration request, this is always migrate\n\n Value\n migrate\n\n template\n\n object (WebRA Migrate Request Template)\n required +\n\n The user-data that will be used to migrate the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n value\n\n string | null\n\n The contact email\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to renew\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to renew\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in a migration\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n object\n required\n\n What this request will do. For a renewal request, this is always renew\n\n Value\n renew\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to renew\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to renew\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (WebRA Renew Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n csr\n\n string | null\n\n The CSR used to renew the certificate, if in decentralized mode\n\n keyType\n\n string | null (Keytype)\n\n The key type of the certificate, if in centralized mode\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n object\n required\n\n What this request will do. For an import request, this is always import\n\n Value\n import\n\n profile\n\n string | null\n\n The profile name on which to import\n\n certificateId\n\n string | null (Internal ID)\n\n The id of the certificate to import\n\n certificatePem\n\n string | null\n\n The PEM encoded certificate to import\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (WebRA Import Request Template)\n +\n\n The user-data that will be added on certificate import\n\n owner\n\n object | null (Certificate Owner)\n +\n\n The owner for this certificate\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n The team for this certificate\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n The contact email for this certificate\n\n value\n\n string | null\n\n The contact email\n\n labels\n\n array of objects | null (Label)\n +\n\n The labels for this certificate\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The third party data associated with the certificate\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n discoveryInfo\n\n object | null (DiscoveryInfo)\n +\n\n Information about the discovery of this certificate\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n discoveryData\n\n object (HostDiscoveryData)\n +\n\n The host discovery data associated with the certificate (discovery metadata)\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n privateKey\n\n string | null\n\n The PEM-encoded private key associated with the certificate. Mandatory if target profile has escrow enabled, forbidden otherwise\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n profile\n\n string\n required\n\n The EST profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For an EST request, this is always est\n\n Value\n est\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n dn\n\n string\n\n Fill the DN if DN whitelist is enabled. Contains the DN of the challenge\n\n password\n\n object | null (SecretString)\n +\n\n The password of the challenge. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (EST Enroll Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n profile\n\n string\n required\n\n The SCEP profile name\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a SCEP request, this is always scep\n\n Value\n scep\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n dn\n\n string\n\n Fill the DN if DN whitelist is enabled. Contains the DN of the challenge\n\n password\n\n object (SecretString)\n +\n\n The password of the challenge. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n template\n\n object (SCEP Enroll Request Template)\n +\n\n The user-data that will be used to generate the challenge\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n Responses\n\n 201\n Request successfully submitted\n\napplication/json\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n template\n\n object (WebRA Enroll Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n keyType\n\n string | null (Keytype)\n\n The type of key that will be used to generate the certificate, if in centralized mode\n\n csr\n\n string | null\n\n If decentralized enrollment is enabled, this field will contain the CSR that will be used to generate the certificate\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n pkcs12\n\n object | null (SecretString)\n +\n\n The generated PKCS#12 for this request. This is only available after the request has been approved in centralized mode\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was generated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate revoked.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For a revocation request, this is always revoke\n\n Value\n revoke\n\n template\n\n object (WebRA Revoke Request Template)\n required +\n\n The user-data that was used to revoke the certificate\n\n revocationReason\n\n string | null (Revocation Reason)\n\n One of: unspecified , keycompromise , cacompromise , affiliationchange , superseded , cessationofoperation\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was revoked for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate updated.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For an update request, this is always update\n\n Value\n update\n\n template\n\n object (WebRA Update Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Information about the certificate's labels and how to edit them\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Information about the certificate's metadata and how to edit them\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was updated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate recovered.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For a recovery request, this is always recover\n\n Value\n recover\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n pkcs12\n\n object | null (SecretString)\n +\n\n The generated PKCS#12 for this request. This is only available after the request has been approved.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was recovered.\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate migrated.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For a migration request, this is always migrate\n\n Value\n migrate\n\n profile\n\n string\n required\n\n The target profile name\n\n template\n\n object (WebRA Migrate Request Template)\n required +\n\n The user-data that will be used to generate the certificate\n\n labels\n\n array of objects | null (Label)\n +\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n owner\n\n object | null (Certificate Owner)\n +\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n value\n\n string | null\n\n The contact email\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was updated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in a migration\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a WebRA request, this is always webra\n\n Value\n webra\n\n workflow\n\n string\n required\n\n What this request will do. For a renewal request, this is always renew\n\n Value\n renew\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n template\n\n object (WebRA Renew Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n csr\n\n string | null\n\n The CSR used to renew the certificate, if in decentralized mode\n\n keyType\n\n string | null (Keytype)\n\n The key type of the certificate, if in centralized mode\n\n pkcs12\n\n object | null (SecretString)\n +\n\n The generated PKCS#12 for this request. This is only available after the request has been approved in centralized mode\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n password\n\n object | null (SecretString)\n +\n\n The password to decrypt the PKCS12 file.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n certificate\n\n object | null (Certificate)\n +\n\n The certificate that was generated for this request. This is only available after the request has been approved\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string (Module)\n required\n\n The module of the certificate imported.\n\n Enum\n webra\n est\n scep\n acme\n crmp\n acme-external\n intune\n jamf\n intunepkcs\n\n workflow\n\n string\n required\n\n What this request will do. For an import request, this is always import\n\n Value\n import\n\n certificate\n\n object | null (Certificate)\n required +\n\n The certificate that was generated for this request.\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n metadata\n\n array of objects (Certificate Metadata)\n required +\n\n The certificate's technical metadata used internally\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n notAfter\n\n integer\n required\n\n The certificate's expiration date in milliseconds since the epoch\n\n thumbprint\n\n string\n required\n\n The certificate's thumbprint\n\n certificate\n\n string\n required\n\n The certificate's PEM-encoded content\n\n dn\n\n string\n required\n\n The certificate's Distinguished Name\n\n revoked\n\n boolean\n required\n\n Whether the certificate is revoked\n\n escrowed\n\n boolean\n required\n\n Whether the certificate is escrowed\n\n issuer\n\n string\n required\n\n The certificate's issuer Distinguished Name\n\n notBefore\n\n integer\n required\n\n The certificate's start date in milliseconds since the epoch\n\n selfSigned\n\n boolean\n required\n\n Whether the certificate is self-signed\n\n keyType\n\n string (Keytype)\n required\n\n The certificate's key type\n\n publicKeyThumbprint\n\n string\n required\n\n The certificate's public key thumbprint\n\n module\n\n string\n required\n\n The certificate's module\n\n holderId\n\n string\n required\n\n The certificate's holder ID. This is a computed field that is used to count how many similar certificates are in use simultaneously by the same holder\n\n subjectAlternateNames\n\n array of objects (SubjectAlternateName)\n required +\n\n The certificate's Subject Alternate Names\n\n Array [\n\n sanType\n\n string\n required\n\n The type of the SAN\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n string\n required\n\n The value of the SAN\n\n ]\n\n serial\n\n string\n required\n\n The certificate's serial number\n\n signingAlgorithm\n\n string\n required\n\n The certificate's signing algorithm\n\n revocationDate\n\n integer | null\n\n The certificate's revocation date in milliseconds since the epoch. This field is only present if the certificate is revoked\n\n grades\n\n array of objects | null (GradingPolicyResult)\n +\n\n The certificate's grades for the enabled grading policies\n\n Array [\n\n name\n\n string\n required\n\n The name of the grading policy\n\n grade\n\n string\n required\n\n The grade awarded by the grading policy\n\n ]\n\n crlSynchronized\n\n boolean | null\n\n Whether the certificate's revocation status is synchronized with a CRL\n\n discoveredTrusted\n\n boolean | null\n\n If the certificate was discovered and is found to be issued by an existing trusted CA, this field will be set to true. If the certificate was discovered and is not found to be issued by an existing trusted CA, this field will be set to false. If the certificate was not discovered, this field will be null\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The certificate's information about synchronization with Horizon supported third parties\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n owner\n\n string | null\n\n The certificate's owner. This is a reference to a local identity identifier\n\n contactEmail\n\n string | null\n\n The certificate's contact email. It will be used to send notifications about the certificate's expiration and revocation\n\n profile\n\n string | null\n\n The certificate's profile\n\n team\n\n string | null\n\n The certificate's team. This is a reference to a team identifier. It will be used to determine the certificate's permissions and send notifications\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The certificate's labels\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n discoveryInfo\n\n array of objects | null (DiscoveryInfo)\n +\n\n A list of metadata containing information on how and when the certificate was discovered\n\n Array [\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n ]\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this certificate\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n extensions\n\n array of objects (CertificateExtension)\n +\n\n The certificate's extensions\n\n Array [\n\n key\n\n string\n required\n\n The extension's type\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string\n required\n\n The extension's value\n\n ]\n\n discoveryData\n\n array of objects | null (HostDiscoveryData)\n +\n\n A list of metadata containing information on where the certificate was discovered\n\n Array [\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n ]\n\n revocationReason\n\n string | null (Revocation Reason)\n\n The certificate's revocation reason\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n holderId\n\n string (Holder ID)\n required\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n template\n\n object (WebRA Import Request Template)\n +\n\n The user-data that will be added on certificate import\n\n owner\n\n object | null (Certificate Owner)\n +\n\n The owner for this certificate\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n The team for this certificate\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n contactEmail\n\n object | null (Contact email)\n +\n\n The contact email for this certificate\n\n value\n\n string | null\n\n The contact email\n\n labels\n\n array of objects | null (Label)\n +\n\n The labels for this certificate\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The technical metadata for this certificate\n\n Array [\n\n metadata\n\n string\n required\n\n Technical metadata related to the certificate\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string | null\n\n The value of the metadata element\n\n ]\n\n thirdPartyData\n\n array of objects | null (ThirdPartyItem)\n +\n\n The third party data associated with the certificate\n\n Array [\n\n connector\n\n string\n required\n\n The third party connector name on which this certificate is synchronized\n\n id\n\n string\n required\n\n The Id of this certificate on the third party\n\n fingerprint\n\n string | null\n\n The fingerprint of this certificate on the third party\n\n pushDate\n\n integer | null\n\n The date when the certificate was pushed to this third party\n\n removeDate\n\n integer | null\n\n The date when the certificate was removed from this third party (in case of revocation)\n\n ]\n\n discoveryInfo\n\n object | null (DiscoveryInfo)\n +\n\n Information about the discovery of this certificate\n\n campaign\n\n string\n required\n\n The discovery campaign's name\n\n lastDiscoveryDate\n\n integer\n required\n\n When this certificate was discovered for the last time\n\n identifier\n\n string | null\n\n Identifier of the user that discovered this certificate\n\n discoveryData\n\n object (HostDiscoveryData)\n +\n\n The host discovery data associated with the certificate (discovery metadata)\n\n ip\n\n string | null\n\n The certificate's host ip\n\n sources\n\n array of string | null\n\n Information on the type of discovery that discovered this certificate\n\n hostnames\n\n array of string | null\n\n The certificate's host hostnames (netscan only)\n\n operatingSystems\n\n array of string | null\n\n The certificate's host operating system (localscan only)\n\n paths\n\n array of string | null\n\n The path to the certificate on the host machine (localscan only)\n\n usages\n\n array of string | null\n\n The path of the configuration files that were used to find the certificates\n\n tlsPorts\n\n array of objects | null (TlsPort)\n +\n\n The ports on which the certificate is exposed for https connexion\n\n Array [\n\n port\n\n integer\n required\n\n The number of the port\n\n version\n\n string\n required\n\n Protocol version used\n\n ]\n\n privateKey\n\n string | null\n\n The PEM-encoded private key associated with the certificate. Mandatory if target profile has escrow enabled, forbidden otherwise\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an import\n\n dn\n\n string\n\n Certificate's Distinguished Name\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n module\n\n string\n required\n\n The module that will be used to process this request. For an EST request, this is always est\n\n Value\n est\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n dn\n\n string\n\n The DN of the challenge\n\n template\n\n object (EST Enroll Request Template)\n +\n\n The user-data that will be used to generate the challenge\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n password\n\n object | null (SecretString)\n +\n\n The password of the challenge.\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n holderId\n\n string (Holder ID)\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n module\n\n string\n required\n\n The module that will be used to process this request. For a SCEP request, this is always scep\n\n Value\n scep\n\n workflow\n\n string\n required\n\n What this request will do. For an enrollment request, this is always enroll\n\n Value\n enroll\n\n _id\n\n string (Internal ID)\n required\n\n Object internal ID\n\n status\n\n string (Request Status)\n required\n\n The request status\n\n Enum\n denied\n approved\n pending\n canceled\n completed\n\n profile\n\n string\n required\n\n The associated profile name\n\n registrationDate\n\n integer\n required\n\n The date the request was created. This is set by the system\n\n lastModificationDate\n\n integer\n required\n\n The date the request was last modified. This is set by the system\n\n removeAt\n\n integer\n required\n\n The date the requested will be deleted. This is set by the system\n\n dn\n\n string\n\n The DN of the challenge\n\n template\n\n object (SCEP Enroll Request Template)\n +\n\n The user-data that will be used to generate the certificate\n\n subject\n\n array of objects | null (IndexedDNElement)\n +\n\n List of DN elements that will be used to build the certificate's Distinguished Name\n\n Array [\n\n element\n\n string\n required\n\n The element type and index. Indexes start at 1! Available elements are: cn , e , ou , st , l , o , c , dc , uid , serialNumber , surname , givenName , unstructuredAddress , unstructuredName , organizationIdentifier , uniqueIdentifier , street , description , t\n\n value\n\n string | null\n\n The element value\n\n ]\n\n sans\n\n array of objects | null (SAN Element)\n +\n\n List of SAN elements that will be used to build the certificate's Subject Alternative Name\n\n Array [\n\n type\n\n string | null\n required\n\n SAN type\n\n Enum\n RFC822NAME\n DNSNAME\n URI\n IPADDRESS\n OTHERNAME_UPN\n OTHERNAME_GUID\n REGISTERED_ID\n\n value\n\n array of string | null\n\n SAN value\n\n ]\n\n extensions\n\n array of objects | null (Certificate Extension)\n +\n\n Information about the certificate's extensions and how to edit them\n\n Array [\n\n type\n\n string\n required\n\n The type of the extension element\n\n Enum\n ms_sid\n ms_template\n ms_template_v2\n\n value\n\n string | null\n\n The value of the extension element\n\n ]\n\n labels\n\n array of objects | null (Label)\n +\n\n List of labels used internally to tag and group certificates\n\n Array [\n\n label\n\n string\n required\n\n The name of the label\n\n value\n\n string | null\n\n The value of the label element\n\n ]\n\n contactEmail\n\n object | null (Contact email)\n +\n\n Information about the certificate's contact email and how to edit it\n\n value\n\n string | null\n\n The contact email\n\n owner\n\n object | null (Certificate Owner)\n +\n\n Information about the certificate's owner and how to edit it\n\n value\n\n string | null\n\n The value of the owner element. This should be a principal identifier\n\n team\n\n object | null (Certificate Team)\n +\n\n Information about the certificate's team and how to edit it\n\n value\n\n string | null\n\n The value of the team element. This should be a team identifier\n\n password\n\n object | null (SecretString)\n +\n\n The password of the challenge. Must be set if password mode is manual\n\n value\n\n string | null\n\n Value of the secret that will be passed to Horizon\n\n requester\n\n string | null\n\n The requester's principal identifier\n\n team\n\n string | null\n\n The team that will be assigned to this certificate. Teams are used to link certificates to people and to assign permissions to them\n\n approver\n\n string | null\n\n The approver's principal identifier\n\n contact\n\n string | null\n\n The request's contact email\n\n requesterComment\n\n string | null\n\n Free-text field editable by the requester to provider more context on the request\n\n approverComment\n\n string | null\n\n Free-text field editable by the approver to provider more context on the request\n\n expirationDate\n\n integer\n\n The date the request will expire. This is set by the system\n\n triggerResults\n\n array of objects | null (TriggerResult)\n +\n\n The result of the execution of triggers on this request\n\n Array [\n\n name\n\n string\n required\n\n The name of the trigger that was executed\n\n event\n\n string\n required\n\n The event that triggered the trigger\n\n Enum\n on_deny_update\n on_cancel_migrate\n on_pending_renew\n on_submit_migrate\n on_cancel_update\n on_approve_migrate\n on_pending_recover\n on_pending_enroll\n on_deny_revoke\n on_cancel_renew\n on_submit_recover\n on_submit_enroll\n on_cancel_recover\n on_approve_revoke\n on_pending_update\n on_deny_recover\n on_approve_renew\n on_deny_migrate\n on_revoke\n on_approve_recover\n on_expire\n on_enroll\n on_deny_renew\n on_approve_update\n on_recover\n on_deny_enroll\n on_submit_renew\n on_update\n on_approve_enroll\n on_cancel_enroll\n on_pending_migrate\n on_pending_revoke\n on_submit_update\n on_submit_revoke\n on_migrate\n on_cancel_revoke\n on_renew\n\n triggerType\n\n string\n required\n\n The type of the trigger\n\n Enum\n aws\n email\n f5client\n ldappub\n intunepkcs\n akv\n webhook\n\n lastExecutionDate\n\n integer\n required\n\n The last time this trigger was executed for this certificate and this event\n\n status\n\n string\n required\n\n The status of the trigger after its execution\n\n Enum\n success\n failure\n\n retryable\n\n boolean\n required\n\n Is this trigger manually retryable (can be run )\n\n retries\n\n integer | null\n\n The number of remaining tries before the trigger is abandoned\n\n nextExecutionDate\n\n integer | null\n\n The next scheduled execution time for this trigger\n\n nextDelay\n\n string | null\n\n Time that will be waited between the next and the next+1 execution of this trigger\n\n detail\n\n string | null\n\n Contains details on this trigger's execution\n\n ]\n\n holderId\n\n string (Holder ID)\n\n The computed holderID for this request. This is set by the system based on DN and SANs\n\n globalHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the Horizon database\n\n profileHolderIdCount\n\n integer | null\n\n The number of certificates that are currently valid and have the same DN and SANs in the same enrollment profile\n\n labels\n\n array of objects | null (LabelData)\n +\n\n The labels set in this request\n\n Array [\n\n key\n\n string\n required\n\n The label's name\n\n value\n\n string\n required\n\n The label's value\n\n ]\n\n metadata\n\n array of objects | null (Certificate Metadata)\n +\n\n The metadata set in this request\n\n Array [\n\n key\n\n string\n required\n\n The metadata name\n\n Enum\n pki_connector\n previous_certificate_id\n renewed_certificate_id\n automation_policy\n gs_order_id\n metapki_id\n digicert_id\n entrust_id\n scep_transid\n fcms_id\n gsatlas_id\n certeurope_id\n digicert_order_id\n\n value\n\n string\n required\n\n The metadata value\n\n ]\n\n dryRun\n\n boolean | null\n\n If true, the request is validated, but will not result in an enrollment\n\n 400\n Invalid request\n\napplication/problem+json\n\n CERT-TEAM-001\n CERT-ELEM-001\n REQ-002\n REQ-004\n REQ-005\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-010\n EST-ENROLL-001\n EST-ENROLL-002\n EST-ENROLL-003\n EST-ENROLL-004\n EST-ENROLL-005\n SCEP-ENROLL-001\n SCEP-ENROLL-002\n SCEP-ENROLL-003\n SCEP-ENROLL-004\n SCEP-ENROLL-005\n WEBRA-ENROLL-001\n WEBRA-ENROLL-002\n WEBRA-ENROLL-003\n WEBRA-ENROLL-004\n WEBRA-ENROLL-005\n WEBRA-ENROLL-006\n WEBRA-ENROLL-009\n WEBRA-ENROLL-012\n WEBRA-RECOVER-001\n WEBRA-RECOVER-002\n WEBRA-RECOVER-003\n WEBRA-RECOVER-004\n WEBRA-REVOKE-001\n WEBRA-REVOKE-003\n WEBRA-REVOKE-004\n WEBRA-REVOKE-005\n WEBRA-REVOKE-006\n WEBRA-MIGRATE-001\n WEBRA-MIGRATE-007\n WEBRA-RENEW-001\n WEBRA-RENEW-003\n WEBRA-RENEW-004\n WEBRA-RENEW-005\n WEBRA-RENEW-006\n WEBRA-IMPORT-001\n WEBRA-IMPORT-003\n WEBRA-IMPORT-004\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CERT-TEAM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Team Element\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Team Element\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n CERT-ELEM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Certificate Element\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Certificate Element\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Request status\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Request status\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Identity Provider\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Identity Provider\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid redirect path\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid redirect path\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Jwt Token\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Jwt Token\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Authorization Mode as DN whitelisting is not enabled on profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Authorization Mode as DN whitelisting is not enabled on profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DN is required as DN whitelisting is enabled on EST profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DN is required as DN whitelisting is enabled on EST profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Distinguished Name\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Distinguished Name\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid EST Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid EST Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid EST Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid EST Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n SCEP pre-validation is not enabled on SCEP profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n SCEP pre-validation is not enabled on SCEP profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n DN is required as DN whitelisting is enabled on SCEP profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n DN is required as DN whitelisting is enabled on SCEP profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Distinguished Name\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Distinguished Name\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid SCEP Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid SCEP Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid SCEP Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid SCEP Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid enrollment mode\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid enrollment mode\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid key type\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid key type\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid certificate request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid certificate request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid subject parameter(s)\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid subject parameter(s)\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid subject alternate name parameter(s)\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid subject alternate name parameter(s)\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid label parameter(s)\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid label parameter(s)\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Enrollment Request Template on approved request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Enrollment Request Template on approved request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-012\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n No certificateId specified\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n No certificateId specified\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority recovery failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority recovery failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Recover Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Recover Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate does not exist\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n No certificate specified\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n No certificate specified\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority revocation request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority revocation request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate does not exist\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid certificate\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid certificate\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Revoke Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Revoke Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-MIGRATE-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n No certificate specified\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n No certificate specified\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-MIGRATE-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid migration profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid migration profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Renewal not enabled on Web Registration Authority Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Renewal not enabled on Web Registration Authority Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate not in its renewal period\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate not in its renewal period\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate status does not allow renewal\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate status does not allow renewal\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-IMPORT-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid request\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-IMPORT-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate key is already escrowed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate key is already escrowed\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 400\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-IMPORT-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Import request does not contain certificate\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Import request does not contain certificate\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 401\n Unauthorized request\n\napplication/problem+json\n\n SEC-AUTH-002\n SEC-AUTH-009\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid credentials or principal does not exist\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid credentials or principal does not exist\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated or authentication expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated or authentication expired\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 401\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 403\n Forbidden action\n\napplication/problem+json\n\n SEC-PERM-001\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n LIC-002\n LIC-003\n LIC-004\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-PERM-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Insufficient privileges\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Insufficient privileges\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is not trusted\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is not trusted\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is expired\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is expired\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Certificate is revoked\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Certificate is revoked\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SEC-AUTH-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Principal not authenticated\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Principal not authenticated\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid License\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Maximum number of holders reached\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Maximum number of holders reached\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n LIC-004\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Expired License\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Expired License\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 403\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 404\n Not found\n\napplication/problem+json\n\n REQ-001\n REQ-003\n REQ-009\n REQ-010\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Request not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Request not found\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Certificate\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Certificate\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Profile does not exist or is disabled\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Profile does not exist or is disabled\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 404\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n 500\n Internal server error\n\napplication/problem+json\n\n REQ-001\n REQ-003\n REQ-010\n EST-ENROLL-006\n EST-ENROLL-007\n EST-ENROLL-008\n EST-ENROLL-009\n SCEP-ENROLL-006\n SCEP-ENROLL-007\n SCEP-ENROLL-008\n SCEP-ENROLL-009\n WEBRA-ENROLL-007\n WEBRA-ENROLL-008\n WEBRA-ENROLL-010\n WEBRA-ENROLL-011\n WEBRA-ENROLL-012\n WEBRA-ENROLL-013\n WEBRA-ENROLL-014\n WEBRA-RECOVER-002\n WEBRA-REVOKE-002\n WEBRA-MIGRATE-005\n WEBRA-RENEW-002\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-001\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unexpected Error\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unexpected Error\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-003\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Request not found\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Request not found\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n REQ-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Profile does not exist or is disabled\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Profile does not exist or is disabled\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing profile EST Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing profile EST Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing approved EST Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing approved EST Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing pending EST Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing pending EST Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n EST-ENROLL-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-006\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing profile SCEP Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing profile SCEP Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing approved SCEP Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing approved SCEP Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing pending SCEP Enrollment Request Template\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing pending SCEP Enrollment Request Template\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n SCEP-ENROLL-009\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-007\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Enrollment Request Template on profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Enrollment Request Template on profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-008\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Enrollment Request Template on pending request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Enrollment Request Template on pending request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-010\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-011\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority enrollment failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority enrollment failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-012\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Enroll Request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-013\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority Profile\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority Profile\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-ENROLL-014\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Invalid Web Registration Authority\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Invalid Web Registration Authority\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RECOVER-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority recovery failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority recovery failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-REVOKE-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority revocation failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority revocation failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-MIGRATE-005\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Missing Web Registration Authority Migrate Request Template on submitted request\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Missing Web Registration Authority Migrate Request Template on submitted request\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n error\n\n string\n required\n\n The error code of the problem\n\n Value\n WEBRA-RENEW-002\n\n message\n\n string\n required\n\n A short, human-readable summary of the problem type\n\n Value\n Web Registration Authority renewal failed\n\n title\n\n string\n required\n\n A short, human-readable summary of the problem type. In compliance with RFC7807\n\n Value\n Web Registration Authority renewal failed\n\n status\n\n integer\n required\n\n The http status code of the error. In compliance with RFC7807\n\n Value\n 500\n\n detail\n\n string | null\n\n A human-readable explanation specific to this occurrence of the problem. In compliance with RFC7807\n\n post\n\n /api/v1/requests/submit\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"workflow\":\n \"revoke\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"workflow\":\n \"update\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"workflow\":\n\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"profile\":\n \"string\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"migrate\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n\n ,\n\n \"template\":\n\n +\n\n {\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n ,\n\n \"keyType\":\n \"rsa-2048\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"certificateId\":\n \"6448d56b310000400063f014\"\n ,\n\n \"certificatePem\":\n \"-----BEGIN CERTIFICATE----- ...\"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n\n ,\n\n \"template\":\n\n +\n\n {\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n ,\n\n \"discoveryData\":\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"privateKey\":\n \"-----BEGIN PRIVATE KEY-----...\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"dn\":\n \"string\"\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"est\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"profile\":\n \"string\"\n ,\n\n \"dn\":\n \"string\"\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"module\":\n \"scep\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n\n }\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n 201\n 400\n 401\n 403\n 404\n 500\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n\n ...\n }\n ,\n\n \"pkcs12\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"revoke\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"update\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"recover\"\n ,\n\n \"pkcs12\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"migrate\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"renew\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"csr\":\n \"-----BEGIN CSR----- ...\"\n ,\n\n \"keyType\":\n \"rsa-2048\"\n\n ...\n }\n ,\n\n \"pkcs12\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"webra\"\n ,\n\n \"workflow\":\n \"import\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"metadata\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n ,\n\n \"discoveryData\":\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n ,\n\n \"privateKey\":\n \"-----BEGIN PRIVATE KEY-----...\"\n\n ...\n }\n ,\n\n \"certificate\":\n\n +\n\n {\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"notAfter\":\n 1609459200000\n ,\n\n \"thumbprint\":\n \"30f727ea932acc3e7ec4716a7c1d1d571a0b9124afbe1d1d81a205562164c69c\"\n ,\n\n \"revocationDate\":\n 0\n ,\n\n \"certificate\":\n \"-----BEGIN CERTIFICATE-----\\nMI....\\n-----END CERTIFICATE-----\"\n ,\n\n \"dn\":\n \"CN=Test Certificate,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"grades\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"Horizon-Grading-Policy\"\n ,\n\n \"grade\":\n \"A\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revoked\":\n true\n ,\n\n \"escrowed\":\n true\n ,\n\n \"issuer\":\n \"CN=Test CA,OU=Test,O=Test,L=Test,ST=Test,C=US\"\n ,\n\n \"notBefore\":\n 1609459200000\n ,\n\n \"crlSynchronized\":\n true\n ,\n\n \"selfSigned\":\n false\n ,\n\n \"discoveredTrusted\":\n true\n ,\n\n \"keyType\":\n \"rsa-2048\"\n ,\n\n \"thirdPartyData\":\n\n +\n\n [\n\n +\n\n {\n\n \"connector\":\n \"F5_connector\"\n ,\n\n \"id\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34\"\n ,\n\n \"fingerprint\":\n \"hrz-hrz-1099-2dc61ac089ddeaab6efab34.1681397142139.crt\"\n ,\n\n \"pushDate\":\n 1681397145000\n ,\n\n \"removeDate\":\n 1681497145000\n\n ...\n }\n\n ...\n ]\n ,\n\n \"owner\":\n \"string\"\n ,\n\n \"publicKeyThumbprint\":\n \"4d0faebaeaa595aba5fafe6040fa8a2143b019b59a2b25ced3b2fb7393ee10e2\"\n ,\n\n \"contactEmail\":\n \" [email protected] \"\n ,\n\n \"module\":\n \"webra\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"team\":\n \"string\"\n ,\n\n \"holderId\":\n \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"discoveryInfo\":\n\n +\n\n [\n\n +\n\n {\n\n \"campaign\":\n \"zone_1_discovery\"\n ,\n\n \"lastDiscoveryDate\":\n 1683988841000\n ,\n\n \"identifier\":\n \"CN=horizon-cli\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"subjectAlternateNames\":\n\n +\n\n [\n\n +\n\n {\n\n \"sanType\":\n \"DNSNAME\"\n ,\n\n \"value\":\n \"docs.evertrust.fr\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"wcce_enrollment\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"serial\":\n \"1\"\n ,\n\n \"signingAlgorithm\":\n \"SHA256WITHRSA\"\n ,\n\n \"discoveryData\":\n\n +\n\n [\n\n +\n\n {\n\n \"ip\":\n \"192.168.1.66\"\n ,\n\n \"sources\":\n\n +\n\n [\n\n \"netscan\"\n\n ...\n ]\n ,\n\n \"hostnames\":\n\n +\n\n [\n\n \"docs.evertrust.fr\"\n\n ...\n ]\n ,\n\n \"operatingSystems\":\n\n +\n\n [\n\n \"windows\"\n\n ...\n ]\n ,\n\n \"paths\":\n\n +\n\n [\n\n \"/etc/ssl/cert.crt\"\n\n ...\n ]\n ,\n\n \"usages\":\n\n +\n\n [\n\n \"/usr/local/nginx/conf/nginx.conf\"\n\n ...\n ]\n ,\n\n \"tlsPorts\":\n\n +\n\n [\n\n +\n\n {\n\n \"port\":\n 443\n ,\n\n \"version\":\n \"TLSv1.2\"\n\n ...\n }\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"revocationReason\":\n \"string\"\n\n ...\n }\n ,\n\n \"dryRun\":\n false\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"dn\":\n \"CN=John Doe,OU=IT,O=Example,C=US\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"est\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"dn\":\n \"CN=test,O=EVERTRUST\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n Collapse all\n Expand all\n Copy\n\n {\n\n \"module\":\n \"scep\"\n ,\n\n \"workflow\":\n \"enroll\"\n ,\n\n \"dn\":\n \"CN=test,O=EVERTRUST\"\n ,\n\n \"template\":\n\n +\n\n {\n\n \"subject\":\n\n +\n\n [\n\n +\n\n {\n\n \"element\":\n \"cn.1\"\n ,\n\n \"value\":\n \"John Doe\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"sans\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"RFC822NAME\"\n ,\n\n \"value\":\n\n +\n\n [\n\n \" [email protected] \"\n ,\n\n \" [email protected] \"\n\n ...\n ]\n\n ...\n }\n\n ...\n ]\n ,\n\n \"extensions\":\n\n +\n\n [\n\n +\n\n {\n\n \"type\":\n \"ms_sid\"\n ,\n\n \"value\":\n \"string\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"label\":\n \"BU\"\n ,\n\n \"value\":\n \"business_unit_1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"contactEmail\":\n\n +\n\n {\n\n \"value\":\n \" [email protected] \"\n\n ...\n }\n ,\n\n \"owner\":\n\n +\n\n {\n\n \"value\":\n \"administrator\"\n\n ...\n }\n ,\n\n \"team\":\n\n +\n\n {\n\n \"value\":\n \"webserver\"\n\n ...\n }\n\n ...\n }\n ,\n\n \"password\":\n\n +\n\n {\n\n \"value\":\n \"zxNT49BtECRYaRYx ...\"\n\n ...\n }\n ,\n\n \"_id\":\n \"6448d56b310000400063f014\"\n ,\n\n \"profile\":\n \"DefaultProfile\"\n ,\n\n \"requester\":\n \"jdoe\"\n ,\n\n \"team\":\n \"IT\"\n ,\n\n \"approver\":\n \"jdoe\"\n ,\n\n \"contact\":\n \" [email protected] \"\n ,\n\n \"requesterComment\":\n \"I need this certificate to access the VPN.\"\n ,\n\n \"approverComment\":\n \"This certificate is for the VPN.\"\n ,\n\n \"registrationDate\":\n 1683021380000\n ,\n\n \"lastModificationDate\":\n 1683021380000\n ,\n\n \"expirationDate\":\n 1683024980000\n ,\n\n \"removeAt\":\n 1685616980640\n ,\n\n \"triggerResults\":\n\n +\n\n [\n\n +\n\n {\n\n \"name\":\n \"push_to_f5_on_enroll\"\n ,\n\n \"event\":\n \"on_enroll\"\n ,\n\n \"triggerType\":\n \"f5client\"\n ,\n\n \"lastExecutionDate\":\n 1609459200000\n ,\n\n \"status\":\n \"failure\"\n ,\n\n \"retries\":\n 4\n ,\n\n \"nextExecutionDate\":\n 1609469200000\n ,\n\n \"nextDelay\":\n \"5 seconds\"\n ,\n\n \"detail\":\n \"Failure while uploading file to F5: F5_connector: No address associated with hostname\"\n ,\n\n \"retryable\":\n true\n\n ...\n }\n\n ...\n ]\n ,\n\n \"holderId\":\n \"453b0d7ac28e079addad4fff633a9b06cdfe2d5626e12cefffbebb462e261a27\"\n ,\n\n \"globalHolderIdCount\":\n 0\n ,\n\n \"profileHolderIdCount\":\n 0\n ,\n\n \"labels\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"business_unit\"\n ,\n\n \"value\":\n \"BU1\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"metadata\":\n\n +\n\n [\n\n +\n\n {\n\n \"key\":\n \"pki_connector\"\n ,\n\n \"value\":\n \"stream_connector\"\n\n ...\n }\n\n ...\n ]\n ,\n\n \"dryRun\":\n false\n\n }\n\n WebRA Enroll Request\n WebRA Revoke Request\n WebRA Update Request\n WebRA Recover Request\n WebRA Migrate Request\n WebRA Renew Request\n WebRA Import Request\n EST Enroll Request\n SCEP Enroll Request\n\n Copy\n\n {\n\n \"error\":\n \"CERT-TEAM-001\"\n ,\n\n \"message\":\n \"Invalid Team Element\"\n ,\n\n \"title\":\n \"Invalid Team Element\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"CERT-ELEM-001\"\n ,\n\n \"message\":\n \"Invalid Certificate Element\"\n ,\n\n \"title\":\n \"Invalid Certificate Element\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-002\"\n ,\n\n \"message\":\n \"Invalid Request\"\n ,\n\n \"title\":\n \"Invalid Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-004\"\n ,\n\n \"message\":\n \"Invalid Request status\"\n ,\n\n \"title\":\n \"Invalid Request status\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-005\"\n ,\n\n \"message\":\n \"Expired Request\"\n ,\n\n \"title\":\n \"Expired Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-007\"\n ,\n\n \"message\":\n \"Invalid Identity Provider\"\n ,\n\n \"title\":\n \"Invalid Identity Provider\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-008\"\n ,\n\n \"message\":\n \"Invalid redirect path\"\n ,\n\n \"title\":\n \"Invalid redirect path\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-010\"\n ,\n\n \"message\":\n \"Invalid Jwt Token\"\n ,\n\n \"title\":\n \"Invalid Jwt Token\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-001\"\n ,\n\n \"message\":\n \"Invalid Authorization Mode as DN whitelisting is not enabled on profile\"\n ,\n\n \"title\":\n \"Invalid Authorization Mode as DN whitelisting is not enabled on profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-002\"\n ,\n\n \"message\":\n \"DN is required as DN whitelisting is enabled on EST profile\"\n ,\n\n \"title\":\n \"DN is required as DN whitelisting is enabled on EST profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-003\"\n ,\n\n \"message\":\n \"Invalid Distinguished Name\"\n ,\n\n \"title\":\n \"Invalid Distinguished Name\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-004\"\n ,\n\n \"message\":\n \"Invalid EST Enroll Request\"\n ,\n\n \"title\":\n \"Invalid EST Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-005\"\n ,\n\n \"message\":\n \"Invalid EST Profile\"\n ,\n\n \"title\":\n \"Invalid EST Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-001\"\n ,\n\n \"message\":\n \"SCEP pre-validation is not enabled on SCEP profile\"\n ,\n\n \"title\":\n \"SCEP pre-validation is not enabled on SCEP profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-002\"\n ,\n\n \"message\":\n \"DN is required as DN whitelisting is enabled on SCEP profile\"\n ,\n\n \"title\":\n \"DN is required as DN whitelisting is enabled on SCEP profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-003\"\n ,\n\n \"message\":\n \"Invalid Distinguished Name\"\n ,\n\n \"title\":\n \"Invalid Distinguished Name\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-004\"\n ,\n\n \"message\":\n \"Invalid SCEP Enroll Request\"\n ,\n\n \"title\":\n \"Invalid SCEP Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-005\"\n ,\n\n \"message\":\n \"Invalid SCEP Profile\"\n ,\n\n \"title\":\n \"Invalid SCEP Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-001\"\n ,\n\n \"message\":\n \"Invalid enrollment mode\"\n ,\n\n \"title\":\n \"Invalid enrollment mode\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-002\"\n ,\n\n \"message\":\n \"Invalid key type\"\n ,\n\n \"title\":\n \"Invalid key type\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-003\"\n ,\n\n \"message\":\n \"Invalid certificate request\"\n ,\n\n \"title\":\n \"Invalid certificate request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-004\"\n ,\n\n \"message\":\n \"Invalid subject parameter(s)\"\n ,\n\n \"title\":\n \"Invalid subject parameter(s)\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-005\"\n ,\n\n \"message\":\n \"Invalid subject alternate name parameter(s)\"\n ,\n\n \"title\":\n \"Invalid subject alternate name parameter(s)\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-006\"\n ,\n\n \"message\":\n \"Invalid label parameter(s)\"\n ,\n\n \"title\":\n \"Invalid label parameter(s)\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-009\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Enrollment Request Template on approved request\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Enrollment Request Template on approved request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-012\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-001\"\n ,\n\n \"message\":\n \"No certificateId specified\"\n ,\n\n \"title\":\n \"No certificateId specified\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-002\"\n ,\n\n \"message\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"title\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-003\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Recover Request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Recover Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-004\"\n ,\n\n \"message\":\n \"Certificate does not exist\"\n ,\n\n \"title\":\n \"Certificate does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-001\"\n ,\n\n \"message\":\n \"No certificate specified\"\n ,\n\n \"title\":\n \"No certificate specified\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-003\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority revocation request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority revocation request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-004\"\n ,\n\n \"message\":\n \"Certificate does not exist\"\n ,\n\n \"title\":\n \"Certificate does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-005\"\n ,\n\n \"message\":\n \"Invalid certificate\"\n ,\n\n \"title\":\n \"Invalid certificate\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-006\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Revoke Request Template\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Revoke Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-MIGRATE-001\"\n ,\n\n \"message\":\n \"No certificate specified\"\n ,\n\n \"title\":\n \"No certificate specified\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-MIGRATE-007\"\n ,\n\n \"message\":\n \"Invalid migration profile\"\n ,\n\n \"title\":\n \"Invalid migration profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-001\"\n ,\n\n \"message\":\n \"Invalid request\"\n ,\n\n \"title\":\n \"Invalid request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-003\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-004\"\n ,\n\n \"message\":\n \"Renewal not enabled on Web Registration Authority Profile\"\n ,\n\n \"title\":\n \"Renewal not enabled on Web Registration Authority Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-005\"\n ,\n\n \"message\":\n \"Certificate not in its renewal period\"\n ,\n\n \"title\":\n \"Certificate not in its renewal period\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-006\"\n ,\n\n \"message\":\n \"Certificate status does not allow renewal\"\n ,\n\n \"title\":\n \"Certificate status does not allow renewal\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 400\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"WEBRA-IMPORT-001\"\n ,\n\n \"message\":\n \"Invalid request\"\n ,\n\n \"title\":\n \"Invalid request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"WEBRA-IMPORT-003\"\n ,\n\n \"message\":\n \"Certificate key is already escrowed\"\n ,\n\n \"title\":\n \"Certificate key is already escrowed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n Copy\n\n {\n\n \"status\":\n 400\n ,\n\n \"error\":\n \"WEBRA-IMPORT-004\"\n ,\n\n \"message\":\n \"Import request does not contain certificate\"\n ,\n\n \"title\":\n \"Import request does not contain certificate\"\n ,\n\n \"detail\":\n \"Details about the error\"\n\n }\n\n CERT-TEAM-001\n CERT-ELEM-001\n REQ-002\n REQ-004\n REQ-005\n SEC-AUTH-007\n SEC-AUTH-008\n SEC-AUTH-010\n EST-ENROLL-001\n EST-ENROLL-002\n EST-ENROLL-003\n EST-ENROLL-004\n EST-ENROLL-005\n SCEP-ENROLL-001\n SCEP-ENROLL-002\n SCEP-ENROLL-003\n SCEP-ENROLL-004\n SCEP-ENROLL-005\n WEBRA-ENROLL-001\n WEBRA-ENROLL-002\n WEBRA-ENROLL-003\n WEBRA-ENROLL-004\n WEBRA-ENROLL-005\n WEBRA-ENROLL-006\n WEBRA-ENROLL-009\n WEBRA-ENROLL-012\n WEBRA-RECOVER-001\n WEBRA-RECOVER-002\n WEBRA-RECOVER-003\n WEBRA-RECOVER-004\n WEBRA-REVOKE-001\n WEBRA-REVOKE-003\n WEBRA-REVOKE-004\n WEBRA-REVOKE-005\n WEBRA-REVOKE-006\n WEBRA-MIGRATE-001\n WEBRA-MIGRATE-007\n WEBRA-RENEW-001\n WEBRA-RENEW-003\n WEBRA-RENEW-004\n WEBRA-RENEW-005\n WEBRA-RENEW-006\n WEBRA-IMPORT-001\n WEBRA-IMPORT-003\n WEBRA-IMPORT-004\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-002\"\n ,\n\n \"message\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"title\":\n \"Invalid credentials or principal does not exist\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 401\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-009\"\n ,\n\n \"message\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"title\":\n \"Principal not authenticated or authentication expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 401\n\n }\n\n SEC-AUTH-002\n SEC-AUTH-009\n\n Copy\n\n {\n\n \"error\":\n \"SEC-PERM-001\"\n ,\n\n \"message\":\n \"Insufficient privileges\"\n ,\n\n \"title\":\n \"Insufficient privileges\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-003\"\n ,\n\n \"message\":\n \"Certificate is not trusted\"\n ,\n\n \"title\":\n \"Certificate is not trusted\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-004\"\n ,\n\n \"message\":\n \"Certificate is expired\"\n ,\n\n \"title\":\n \"Certificate is expired\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-005\"\n ,\n\n \"message\":\n \"Certificate is revoked\"\n ,\n\n \"title\":\n \"Certificate is revoked\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SEC-AUTH-006\"\n ,\n\n \"message\":\n \"Principal not authenticated\"\n ,\n\n \"title\":\n \"Principal not authenticated\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"LIC-002\"\n ,\n\n \"message\":\n \"Invalid License\"\n ,\n\n \"title\":\n \"Invalid License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"LIC-003\"\n ,\n\n \"message\":\n \"Maximum number of holders reached\"\n ,\n\n \"title\":\n \"Maximum number of holders reached\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"LIC-004\"\n ,\n\n \"message\":\n \"Expired License\"\n ,\n\n \"title\":\n \"Expired License\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 403\n\n }\n\n SEC-PERM-001\n SEC-AUTH-003\n SEC-AUTH-004\n SEC-AUTH-005\n SEC-AUTH-006\n LIC-002\n LIC-003\n LIC-004\n\n Copy\n\n {\n\n \"error\":\n \"REQ-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-003\"\n ,\n\n \"message\":\n \"Request not found\"\n ,\n\n \"title\":\n \"Request not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-009\"\n ,\n\n \"message\":\n \"Invalid Certificate\"\n ,\n\n \"title\":\n \"Invalid Certificate\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-010\"\n ,\n\n \"message\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"title\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 404\n\n }\n\n REQ-001\n REQ-003\n REQ-009\n REQ-010\n\n Copy\n\n {\n\n \"error\":\n \"REQ-001\"\n ,\n\n \"message\":\n \"Unexpected Error\"\n ,\n\n \"title\":\n \"Unexpected Error\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-003\"\n ,\n\n \"message\":\n \"Request not found\"\n ,\n\n \"title\":\n \"Request not found\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"REQ-010\"\n ,\n\n \"message\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"title\":\n \"Profile does not exist or is disabled\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-006\"\n ,\n\n \"message\":\n \"Missing profile EST Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing profile EST Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-007\"\n ,\n\n \"message\":\n \"Missing approved EST Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing approved EST Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-008\"\n ,\n\n \"message\":\n \"Missing pending EST Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing pending EST Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"EST-ENROLL-009\"\n ,\n\n \"message\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"title\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-006\"\n ,\n\n \"message\":\n \"Missing profile SCEP Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing profile SCEP Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-007\"\n ,\n\n \"message\":\n \"Missing approved SCEP Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing approved SCEP Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-008\"\n ,\n\n \"message\":\n \"Missing pending SCEP Enrollment Request Template\"\n ,\n\n \"title\":\n \"Missing pending SCEP Enrollment Request Template\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"SCEP-ENROLL-009\"\n ,\n\n \"message\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"title\":\n \"Unable to validate pending request. The EST profile was modified and the request can only be canceled or denied\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-007\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Enrollment Request Template on profile\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Enrollment Request Template on profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-008\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Enrollment Request Template on pending request\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Enrollment Request Template on pending request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-010\"\n ,\n\n \"message\":\n \"Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\"\n ,\n\n \"title\":\n \"Unable to validate pending enroll request. The Web Registration Authority profile was modified and the request can only be canceled or denied\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-011\"\n ,\n\n \"message\":\n \"Web Registration Authority enrollment failed\"\n ,\n\n \"title\":\n \"Web Registration Authority enrollment failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-012\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Enroll Request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-013\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority Profile\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-ENROLL-014\"\n ,\n\n \"message\":\n \"Invalid Web Registration Authority\"\n ,\n\n \"title\":\n \"Invalid Web Registration Authority\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RECOVER-002\"\n ,\n\n \"message\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"title\":\n \"Web Registration Authority recovery failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-REVOKE-002\"\n ,\n\n \"message\":\n \"Web Registration Authority revocation failed\"\n ,\n\n \"title\":\n \"Web Registration Authority revocation failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-MIGRATE-005\"\n ,\n\n \"message\":\n \"Missing Web Registration Authority Migrate Request Template on submitted request\"\n ,\n\n \"title\":\n \"Missing Web Registration Authority Migrate Request Template on submitted request\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n Copy\n\n {\n\n \"error\":\n \"WEBRA-RENEW-002\"\n ,\n\n \"message\":\n \"Web Registration Authority renewal failed\"\n ,\n\n \"title\":\n \"Web Registration Authority renewal failed\"\n ,\n\n \"detail\":\n \"Details about the error\"\n ,\n\n \"status\":\n 500\n\n }\n\n REQ-001\n REQ-003\n REQ-010\n EST-ENROLL-006\n EST-ENROLL-007\n EST-ENROLL-008\n EST-ENROLL-009\n SCEP-ENROLL-006\n SCEP-ENROLL-007\n SCEP-ENROLL-008\n SCEP-ENROLL-009\n WEBRA-ENROLL-007\n WEBRA-ENROLL-008\n WEBRA-ENROLL-010\n WEBRA-ENROLL-011\n WEBRA-ENROLL-012\n WEBRA-ENROLL-013\n WEBRA-ENROLL-014\n WEBRA-RECOVER-002\n WEBRA-REVOKE-002\n WEBRA-MIGRATE-005\n WEBRA-RENEW-002\n\n Retrieve a request template\n Retrieve a request", "keywords": [ "submit", "request", diff --git a/src/generated/docs/companion-doc-pages.json b/src/generated/docs/companion-doc-pages.json index 606f5c1..8e624bf 100644 --- a/src/generated/docs/companion-doc-pages.json +++ b/src/generated/docs/companion-doc-pages.json @@ -1,6 +1,6 @@ { - "generatedAt": "2026-04-14T15:50:18.413Z", - "pageCount": 201, + "generatedAt": "2026-04-28T14:21:29.349Z", + "pageCount": 215, "pages": [ { "page_id": "adcs-connector:1:install-guide:initial-config", @@ -259,7 +259,7 @@ "Uninstallation Procedure" ], "summary": "Uninstallation Procedure Uninstalling ADCS Connector Uninstalling ADCS Connector consists in uninstalling: The EverTrust ADCS Connector service; 1. Log in to the ADCS Connector server with administrative privileges . 2. Open the Control Pan", - "content": "Uninstallation Procedure\n\n Uninstalling ADCS Connector\n\n Uninstalling ADCS Connector consists in uninstalling:\n\n The EverTrust ADCS Connector service;\n\n 1. Log in to the ADCS Connector server with administrative privileges .\n\n 2. Open the Control Panel\n\n 3. In the Programs section, click Uninstall a program.\n\n 4. Search EverTrust ADCS Connector .\n\n 5. Once found click Uninstall\n\n Clean up\n\n 1. Log in to the WinHorizon server with administrative privileges .\n\n 2. Delete the %USERPROFILE%\\Program Files\\EverTrust directory.\n\n 3. Delete the %USERPROFILE%\\ProgramData\\EverTrust directory.\n\n 4. If ADCS Connector TLS certificate has been stored on Microsoft Certificate store, remove the private key and the associated certificate .\n\n ADCS Connector certificate revocation\n\n Ask a Horizon administrator to revoke the ADCS Connector TLS certificate.\n\n Initial Configuration\n ADCS Connector 1.1.0 release notes", + "content": "Uninstallation Procedure\n\n Uninstalling ADCS Connector\n\n Uninstalling ADCS Connector consists in uninstalling:\n\n The EverTrust ADCS Connector service;\n\n 1. Log in to the ADCS Connector server with administrative privileges .\n\n 2. Open the Control Panel\n\n 3. In the Programs section, click Uninstall a program.\n\n 4. Search EverTrust ADCS Connector .\n\n 5. Once found click Uninstall\n\n Clean up\n\n 1. Log in to the WinHorizon server with administrative privileges .\n\n 2. Delete the %USERPROFILE%\\Program Files\\EverTrust directory.\n\n 3. Delete the %USERPROFILE%\\ProgramData\\EverTrust directory.\n\n 4. If ADCS Connector TLS certificate has been stored on Microsoft Certificate store, remove the private key and the associated certificate .\n\n ADCS Connector certificate revocation\n\n Ask a Horizon administrator to revoke the ADCS Connector TLS certificate.\n\n Initial Configuration\n ADCS Connector 1.1.1 release notes", "keywords": [ "uninstallation", "procedure", @@ -287,7 +287,34 @@ "ADCS Connector 1.1.0 release notes" ], "summary": "ADCS Connector 1.1.0 release notes Here are the release notes for EverTrust ADCS Connector v1.1.0, released on 2025-12-02. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features Servi", - "content": "ADCS Connector 1.1.0 release notes\n\n Here are the release notes for EverTrust ADCS Connector v1.1.0, released on 2025-12-02.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n Service no longer requires the technical account to have login permissions on the machine where the connector is installed.\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n The ADCS Connector service can now be upgraded without requiring uninstallation of the previous version.\n\n 4. Known defects\n\n [None]\n\n Uninstallation Procedure", + "content": "ADCS Connector 1.1.0 release notes\n\n Here are the release notes for EverTrust ADCS Connector v1.1.0, released on 2025-12-02.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n Service no longer requires the technical account to have login permissions on the machine where the connector is installed.\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n The ADCS Connector service can now be upgraded without requiring uninstallation of the previous version.\n\n 4. Known defects\n\n [None]\n\n ADCS Connector 1.1.1 release notes", + "keywords": [ + "adcs", + "connector", + "release", + "notes", + "release-notes", + "release-notes/1" + ] + }, + { + "page_id": "adcs-connector:1.1:release-notes:1.1.1", + "product": "adcs-connector", + "kind": "companion", + "source": "antora", + "version": "1.1", + "title": "ADCS Connector 1.1.1 release notes", + "section": "release-notes", + "slug": "release-notes/1.1.1", + "url": "https://docs.evertrust.fr/adcs-connector/1.1/release-notes/1.1.1.html", + "canonical_url": "https://docs.evertrust.fr/adcs-connector/1.1/release-notes/1.1.1.html", + "breadcrumbs": [ + "ADCS Connector", + "Release notes", + "ADCS Connector 1.1.1 release notes" + ], + "summary": "ADCS Connector 1.1.1 release notes Here are the release notes for EverTrust ADCS Connector v1.1.1, released on 2026-04-17. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features ADCS ", + "content": "ADCS Connector 1.1.1 release notes\n\n Here are the release notes for EverTrust ADCS Connector v1.1.1, released on 2026-04-17.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n ADCS Connector can now pickup nlog.config to configure logging from the execution directory, if it exists.\n\n 2. Enhancements\n\n Logging will now occur on endpoint calls in addition to already existing logs\n\n 3. Bug Fixes\n\n [None]\n\n 4. Known defects\n\n [None]\n\n Uninstallation Procedure\n ADCS Connector 1.1.0 release notes", "keywords": [ "adcs", "connector", @@ -569,7 +596,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -597,7 +624,7 @@ "section": "basic.html", "slug": "basic.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", @@ -613,7 +640,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -629,7 +656,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -654,7 +681,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n To specify a proxy dedicated to Qualys CV, you can use the flag --external-proxy with the proxy address and port as value.\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword --external-proxy=\"http://qualyscv.proxy:8888\"\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n To specify a proxy dedicated to Nessus, you can use the flag --external-proxy with the proxy address and port as value.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5 --external-proxy=\"http://nessus.proxy:8888\"\n\n Basic commands\n Import operations", @@ -670,7 +697,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -694,7 +721,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key> --external-proxy=<proxy address:port>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key> --external-proxy=<proxy address:port>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret> --external-proxy=<proxy address:port>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password> --external-proxy=<proxy address:port>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n GlobalSign\n\n You can import all your valid certificates from GlobalSign. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport globalsign --campaign=test --username=<AuthToken Username> --password=<AuthToken Password> --order-status=<OrderStatus> --external-proxy=<proxy address:port>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -710,7 +737,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.10 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", @@ -842,7 +869,7 @@ "section": "requirements.html", "slug": "requirements.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", @@ -858,7 +885,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -885,7 +912,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -909,7 +936,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.10/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -936,7 +963,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -964,7 +991,7 @@ "section": "basic.html", "slug": "basic.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", @@ -980,7 +1007,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -996,7 +1023,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -1021,7 +1048,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", @@ -1037,7 +1064,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -1061,7 +1088,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -1077,7 +1104,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.11 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", @@ -1209,7 +1236,7 @@ "section": "requirements.html", "slug": "requirements.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", @@ -1225,7 +1252,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -1252,7 +1279,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -1276,7 +1303,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.11/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -1303,7 +1330,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -1331,7 +1358,7 @@ "section": "basic.html", "slug": "basic.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", @@ -1347,7 +1374,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -1363,7 +1390,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -1388,7 +1415,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", @@ -1404,7 +1431,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -1428,7 +1455,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -1444,7 +1471,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.12 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", @@ -1576,7 +1603,7 @@ "section": "requirements.html", "slug": "requirements.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", @@ -1592,7 +1619,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -1619,7 +1646,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -1643,7 +1670,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.12/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -1670,7 +1697,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -1698,7 +1725,7 @@ "section": "basic.html", "slug": "basic.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", @@ -1714,7 +1741,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -1730,7 +1757,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -1755,7 +1782,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", @@ -1771,7 +1798,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -1795,7 +1822,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -1811,7 +1838,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.13 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", @@ -1856,7 +1883,7 @@ "section": "requirements.html", "slug": "requirements.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", @@ -1872,7 +1899,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -1899,7 +1926,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -1923,7 +1950,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.13/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -1950,7 +1977,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -1978,7 +2005,7 @@ "section": "basic.html", "slug": "basic.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", @@ -1994,7 +2021,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -2010,7 +2037,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -2035,7 +2062,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", @@ -2051,7 +2078,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -2075,7 +2102,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -2091,7 +2118,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.14 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", @@ -2165,7 +2192,7 @@ "section": "requirements.html", "slug": "requirements.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit).\n\n Introduction\n General Configuration and Usage", @@ -2181,7 +2208,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -2208,7 +2235,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -2232,7 +2259,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.14/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -2259,7 +2286,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -2287,7 +2314,7 @@ "section": "basic.html", "slug": "basic.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", "breadcrumbs": ["Horizon Client", "Basic commands"], "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", @@ -2303,7 +2330,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -2319,7 +2346,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\nIn case you want to change the whole configuration file, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", @@ -2344,7 +2371,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Basic commands\n Import operations", @@ -2360,7 +2387,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -2384,7 +2411,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -2400,7 +2427,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.15 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", @@ -2474,7 +2501,7 @@ "section": "requirements.html", "slug": "requirements.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", "breadcrumbs": ["Horizon Client", "Requirements"], "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Introduction\n General Configuration and Usage", @@ -2490,7 +2517,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -2517,7 +2544,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -2541,7 +2568,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -2558,6 +2585,286 @@ "client" ] }, + { + "page_id": "horizon-cli:1.16:automation.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Automation", + "section": "automation.html", + "slug": "automation.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", + "breadcrumbs": [ + "Horizon Client", + "Automatic TLS Certificate Installation" + ], + "summary": "Automation The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly usef", + "content": "Automation\n\n The horizon-cli automate command helps you automate the installation of your TLS certificates. It is designed to streamline the process of certificate enrollment, renewal, and installation. This functionality is particularly useful for managing Transport Layer Security (TLS) on web servers, ensuring secure and encrypted connections. It simplifies complex operations through its suite of subcommands, each tailored for specific aspects of certificate management.\n\n Subcommands\n\n To begin with Horizon CLI automation, use the --help flag with any subcommand for detailed usage information:\n\n ./horizon-cli automate <subcommand> --help\n\n Table 1. Automation module subcommands\n\n Subcommand\n Description\n\n enroll\n\n This command is versatile, functioning similarly to the init command on servers without certificates, while also capable of re-enrolling or taking control of servers with existing certificates.\n\n init\n\n This command is designed to automatically configure SSL on any newly installed web server. When executed, it seamlessly sets up a secure connection by arranging SSL certificates and enabling SSL on the default HTTPS port (usually port 443). The process includes configuring the necessary SSL settings and restarting the server with SSL enabled.\n\n control\n\n This command is designed to locate certificates within a web server’s configuration and offers to bring them under automation control. Taking a certificate under control involves adding necessary metadata and incorporating it into the local memory for routine management and oversight. This process ensures that the certificates are systematically monitored and managed as part of the automated workflow.\nBe aware that enrolling a new certificate will replace any certificate currently bound to an application running on your machine.\n\n modify\n\n This command allows the user to select one of the managed certificates and modify its sans.\n\n edit\n\n This command allows the user to change values on the state of currently managed certificates.\n\n create-periodic-task\n\n Sets up a routine task for automated certificate renewal. The task frequency can be specified, with a default period of 6 hours. This helps in automating the renewal process to ensure certificates remain valid without manual intervention.\n\n remove-periodic-task\n\n Removes the previously set periodic task for certificate renewal. This is useful when automated renewal is no longer needed or needs to be reconfigured.\n\n routine\n\n Performs a routine check on all managed certificates to assess if any need renewal. This is a part of proactive certificate management to avoid service disruptions.\n\n list\n\n Lists all managed certificates. This provides an overview of all certificates under management, including details like expiration dates, domains covered, etc.\n\n remove\n\n Removes a managed certificate or a group of certificates. The <id> parameter specifies which certificates to remove, with the option to remove all services using a keyword like 'all'.\n\n If you’re looking for a more guided experience while using horizon-cli automate, the --prompt flag is an excellent tool. It enables interactive prompts that guide you step-by-step through the command’s options, making it easier to configure and execute your commands accurately.\n\n ./horizon-cli automate <subcommand> --prompt\n\n Supported Services\n\n The horizon-cli automate feature supports a variety of web server and application server services.\nThis ensures a wide range of compatibility and flexibility for users working with different server environments.\nThe --target flag is used within the tool to specify the specific service on which to perform automation tasks, allowing for precise and targeted configuration and management.\n\nIn order for horizon-cli to function properly, the targeted service should be started on the machine.\n\n List of the supported services:\n\n nginx (Linux)\n\n apache (Linux)\n\n haproxy (Linux)\n\n jboss wildfly (Linux)\n\n lighttpd (Linux)\n\n microsoft iis (Windows)\n\n evertrust winhorizon (Windows)\n\n evertrust adcsconnector (Windows)\n\n Windows (Windows)\n\n tomcat (Linux & Windows)\n\n generic (Linux & Windows)\n\n Example of a standard setup on the default HTTPS port (443) for NGINX:\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME>\n\n To set up SSL on a custom port (e.g., 9000), use the --PORT flag. This option allows SSL configuration on a specific port of your Nginx server.\n\n ./horizon-cli automate init --target=nginx --automation-policy=<POLICY_NAME> --PORT=9000\n\nFor microsoft iis , evertrust winhorizon and evertrust adcsconnector services, the renewal will remove the old certificates (except the original one for backup purposes) from the windows store.\n\n Generic Service Automation\n\n The Generic Service within the Horizon Client’s automation module provides a versatile and user-friendly method for obtaining TLS certificates, eliminating the need to specify a pre-existing service or certificate file. This feature is especially beneficial in scenarios where certificates are required to be generated dynamically or for users who seek a more automated certificate management process.\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=generic --prompt\n\n Non-Interactive Mode: For an even more streamlined experience, certificates can be automatically generated with default parameters in non-interactive mode.\n\n ./horizon-cli automate init --target=generic --automation-policy=<POLICY_NAME> --cert=my_cert.pem --key=my_key.key --chain-file=my_chain.pem --no-interactive\n\n Default Storage Location: Newly generated certificates are automatically stored in a default location, which is /opt/horizon/var/generic on Unix systems, and C:\\ProgramData\\EverTrust\\Horizon\\Var\\Generic on Windows systems.\n\n Configuration Folder Override: Users have the flexibility to override the default storage location using the --config-folder option. This allows for customization of the storage path as per individual requirements or organizational standards.\n\n ./horizon-cli automate init --config-folder=/path/to/folder --target=generic --automation-policy=<POLICY_NAME> --pfx=my_cert.p12 --pfx-pwd=pass123 --chain-file=my_chain.pem --no-interactive\n\n The Generic Service’s emphasis on flexibility and user-friendliness makes it a valuable tool for a wide range of users, from those requiring on-the-fly certificate generation to those preferring a hands-off, automated approach.\n\n Windows-Specific Features:\nOn Windows systems, the Horizon CLI offers additional flags to specify the certificate store location:\n\n --win-user-store : Save the certificate in the user store. This option is beneficial when certificates need to be accessible on a per-user basis.\n\n --win-computer-store : Save the certificate in the computer store. Ideal for certificates that must be available system-wide.\n\n These options provide flexibility in managing certificate storage, catering to different security and accessibility requirements on Windows systems.\n\n Windows Service Automation\n\n The windows target handles application that use a certificate in the Windows store without specific configuration files.\n\n It supports:\n\n Remote Desktop certificates ( rdp )\n\n Domain Controller certificates ( domaincontroller )\n\n To enroll a RDP certificate:\n\n Through the interactive mode:\n\n ./horizon-cli automate init --target=windows --prompt\n\n Non-Interactive Mode: Specific windows usages can be targeted using the --win-usages option\n\n ./horizon-cli automate init --target=windows --win-usages rdp,domaincontroller\n\n Automation policies\n\n Automation policies are central to the operation of the automation module in the Horizon system. These policies dictate how certificates should be enrolled and renewed, providing a customizable framework to suit various client requirements.\n\n Before using automation policies, they must be pre-configured in the Horizon web app. Each policy is given a unique name for easy identification.\n\n Profile Selection: Policies can be based on EST, SCEP, WebRA or ACME profiles, depending on the specific requirements of the enrollment and renewal process.\n\nEverTrust recommends using EST for most use cases of server automation.\n\n Execution Policy: Includes settings that define how and when the automation should be executed.\n\n Compliance Settings:\nSpecify which CAs are authorized for use within the policy.\n\n Authorized Hash Algorithms: Determine which hash algorithms are acceptable.\n\n Trust Chains: Configure the trust chains that are essential for establishing the trustworthiness of the certificates.\n\n Parameter Specification: When performing automation operations, the relevant automation policy is specified using the --automation-policy parameter.\n\n Existing WebServer certificates\n\n The Horizon CLI’s automation module is equipped with a discovery feature that scans and identifies certificates on your machine. It does this by parsing configuration files of your web server or TLS service.\n\n By default, it searches for certificates across all supported services.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME>\n\n Limit the search to specific services. Separate multiple services with commas.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx\n\n If you use a different config folder than the default one you can specify your custom folder using --config-folder\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --config-folder=/path/to/folder\n\n Perform only the discovery phase and print the results without enrolling certificates using --analyze-only :\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --target=apache,nginx --analyze-only\n\n The --discovery parameter allows you to integrate certificate enrollment with a discovery campaign pre configured in the Horizon web app before running the CLI command. It includes additional information on the certificate’s usage and location on the host machine.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --discovery-campaign=<DISCOVERY_CAMPAIGN_NAME>\n\n Additional enrollment parameters\n\n Challenge Passwords for Enrollment\n\n The --challenge parameter is used to provide challenge passwords for EST or SCEP during the enrollment process. Challenge passwords are crucial for the authentication phase in these protocols, ensuring secure communication and identity verification.\n\n When enrolling certificates using EST or SCEP protocols, the --challenge parameter allows you to specify one or more challenge passwords required by the enrollment server.\nMultiple challenge passwords can be provided, separated by commas, to support various scenarios or multiple servers enrollment.\n\n You can also use the --request-challenge parameter to create a challenge request on Horizon. When the challenge request will be validated a periodic task will get the challenge and finish the enrollment. The periodic task can be configured with the --challenge-routine-period parameter.\n\nYou must be authenticated to use the --request-challenge parameter.\n\n Post-Enrollment Script Execution\n\n The --script parameter allows the execution of a custom script upon the successful completion of a certificate enrollment process. It supports both Bash scripts in Linux environments and PowerShell scripts in Windows environments.\n\n ./horizon-cli automate enroll --automation-policy=<POLICY_NAME> --script=/home/user/post_enroll.sh\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Storage information\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\necho $5\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer, $storage)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\nWrite-Output $storage\n\n Storage information\n\n The storage information is a JSON array containing information about the storage, with one object per storage.\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Storage are often linked to a target. Here are the available storages for each target:\n\n apache : Certificate, chain and key in separate files or Chain and key in separate files\n\n nginx : Chain and key in separate files\n\n tomcat : Certificate, chain and key in separate files or JKS or PKCS#12\n\n lighttpd : Chain and key in separate files\n\n wildfly : JKS or PKCS#12\n\n iis : Windows store entry\n\n winhorizon : Windows store entry or PKCS#12\n\n adcsconnector : Windows store entry\n\n windows : Windows store entry\n\n generic : Certificate, chain and key in separate files or Windows store entry or JKS or PKCS#12\n\n haproxy : Chain and key in separate files or Chain and key in a single file\n\n Storage Types\n\n Chain and key in a single file\n\n Description :\n\n path contains the path to the certificate chain (including leaf certificate, in leaf to root order) followed by the certificate private key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"bundle\",\n \"path\": \"/path/to/cert+chain+key\"\n }\n]\n\n Chain and key in separate files\n\n Description :\n\n chainPath contains the path to the certificate chain (including leaf certificate, in leaf to root order) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n Example:\n\n [\n {\n \"type\": \"chainKey\",\n \"chainPath\": \"/path/to/cert+chain\",\n \"keyPath\": \"/path/to/key\"\n }\n]\n\n Certificate, chain and key in separate files\n\n Description :\n\n certPath contains the path to the certificate (without chain) in PEM format\n\n keyPath contains the path to the certificate key in PEM format\n\n caChainPath contains the path to the certificate chain (excluding leaf certificate, in leaf to root order) in PEM format\n\n certFormat contains the format of the certificate file (PEM or DER)\n\n Example:\n\n [\n {\n \"type\": \"certChainKey\",\n \"certPath\": \"/path/to/cert\",\n \"keyPath\": \"/path/to/key\",\n \"caChainPath\": \"/path/to/chain\",\n \"certFormat\": \"PEM or DER\"\n }\n]\n\n Windows store entry\n\n Description :\n\n thumbprint contains the thumbprint of the certificate in the windows store\n\n machineStore if true, means the certificate is stored in the machine store, else in the user store\n\n Example:\n\n [\n {\n \"type\": \"windowsStore\",\n \"thumbprint\": \"thumbprint of the certificate\",\n \"machineStore\": false\n }\n]\n\n JKS\n\n Description :\n\n path is the path to the JKS file\n\n alias contains the alias in which the certificate is stored\n\n password contains the JKS password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"jks\",\n \"path\": \"/path/to/jks\",\n \"alias\": \"jks alias\",\n \"password\": \"jks password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n PKCS#12\n\n Description :\n\n path is the path to the pkcs12 file\n\n password contains the pkcs12 password\n\n caChainPath (optional) contains the path to the chain file (excluding leaf certificate, in root to leaf order) in PEM format\n\n Example:\n\n [\n {\n \"type\": \"pkcs12\",\n \"path\": \"/path/to/pkcs12\",\n \"password\": \"pkcs12 password\",\n \"caChainPath\": \"/path/to/chain\"\n }\n]\n\n Metadata parameters\n\n Add metadata to certificates during the enrollment process :\nThese certificate information parameters enhance the management and traceability of TLS certificates. By using these optional fields, organizations can maintain better oversight and control over their certificate infrastructure.\n\n Table 2. Metadata parameters\n\n Parameter\n Description\n\n --owner\n\n Owner of the certificate\n\n --contact-email\n\n Contact email of the certificate owner\n\n --team\n\n Team owning the certificate\n\n --labels\n\n Labels to attach to the certificate, in the form key:value\n\n ACME Account Specification for Enrollment\n\n The --acme-account parameter is mandatory when enrolling certificates using the ACME protocol. It specifies the ACME account to be used for the enrollment process.\n\n ./horizon-cli automate enroll --acme-account=myAcmeAccount\n\n Installation\n\n After a successful enrollment or renewal, the certificate will be installed on your machine.\nThe impacted services will be restarted automatically after each certificate enrollment or renewal.\n\n In certain scenarios, you might not want the Horizon CLI to automatically install the new certificate or restart the related services.\n\n If you wish for the client to not install your new certificate, that is, not replace the old certificate and not restart the impacted services, you can use the --no-install option. Each new file (cert, key, CA chain, keystore…​) will then be placed in the same folder as it’s predecessor, with the .new extension.\n\n Renewal\n\n Each time a certificate is discovered and enrolled by the automation module of the Horizon Client, its details are stored in the internal database for future reference.\nEach time the automate routine command is run, the client will check if any of the locally known certificates need to be renewed.\nReasons for renewal can be:\n\n The certificate is about to expire\n\n The certificate has been revoked\n\n Preferences such as key type or enrollment CA were changed in the profile or automation policy\n\n If a certificate needs to be renewed, the client will perform the renewal according to the automation policy, and its corresponding profile.\n\n We recommend that you run the automate routine command periodically as a cron job or scheduled task.\nYou can use the command horizon-cli automate create-periodic-task <period> or the flag --auto-renew on the automate enroll command to help you in the process, or create it manually.\n\n This mechanism allows for more resilient web servers, as the certificates will be renewed automatically, before any interruption of service can happen because of an expired or revoked certificate. It also helps your organisation migrate your TLS certificates to a new CA quickly, by simply changing the preferred enrollment CA in the automation policy and waiting a few hours for all your instances of the Horizon Client to execute their routine tasks.\n\n Using --auto-renew flag will check and check the certificate every 6 hours:\n\n ./horizon-cli automate enroll --target=nginx --automation-policy=<POLICY_NAME> --auto-renew\n\n Interactivity\n\n Two options are available to control the interactivity of the automate commands:\n\n The --no-interactive flag will prevent any prompt from being displayed, and will use the default values or those provided in the command line arguments. It will:\n\n select all discovered certificates for enrollment. In order to select specific certificates without interaction, the --select-certs flag can be used to specify a glob matching the website identifier.\n\n Example:\nRunning the automate enroll --analyze-only --automation-policy <automation policy name> returns the following result:\n\n CN\n Locations\n Bindings\n\n New Certificate\n\n Not yet prompted\n\n generic-893c8435-08c5-4d2d-b9f6-88b952b34ca4\n\n New Certificate\n\n /etc/pki/nginx/server.crt\n\n nginx-*:443\n\n To select and enroll only the nginx cert, the following command can be used\n automate enroll --automation-policy <automation policy name> --no-interactive --select-certs nginx*\n\n if a challenge is required, use the provided --challenge argument. If no challenge is provided, or the given challenge has already been used, the enrollment will fail.\n\n not add any additional SANs\n\n The --prompt flag will force the client to prompt the user for any missing information. If specified, any other command line arguments are optional. It will:\n\n prompt the user to select which services to search for on the machine (equivalent to the --target option)\n\n prompt the user for the automation policy (equivalent to the --automation-policy option)\n\n prompt the user for the configuration folder (equivalent to the --config-folder option)\n\n Certificate commands\n\n Enroll\n\n The enroll command can either setup a certificate and empty https configuration from scratch, or take control of certificates, reenrolling them to be compliant when necessary.\n\n Parameters\n\n Table 3. Enroll general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --force-enroll\n\n boolean\n\n Reenroll all selected certificates regardless of their compliance.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 4. Enroll webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 5. Enroll certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 6. Enroll ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 7. Enroll ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 8. Enroll generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 9. Enroll windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https or control a nginx service\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate enroll --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Init\n\n The init command can setup a certificate and empty https configuration from scratch.\n\nThe init command can only be used on webservers where no certificate is configured in order to avoid conflicts.\nSee the other commands to match your use case.\n\n Parameters\n\n Table 10. Init general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the enrollments, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 11. Init webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --port\n\n integer\n\n When initializing an empty https configuration on a blank server, choose on which port to listen for https (defaults to the standard https port for the webserver 443 or 8443 )\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 12. Init certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 13. Init ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\n --eab-kid\n\n string\n\n Kid for External Account Binding\n\n --eab-key\n\n string\n\n Key for External Account Binding\n\n Table 14. Init ACME External options\n\n Parameter\n Mandatory\n Type\n Description\n\n --standalone\n\n boolean\n\n Use built in http server\n\n --local\n\n boolean\n\n Use an existing http server\n\n --document-root\n\n string\n\n Path of the document root where to put the well-known folder for the challenge\n\n Table 15. Init generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --destination-folder\n\n string (path to folder)\n\n Folder to write the new certificates to. Default to /opt/horizon/var/generic on linux and C:\\ProgramData\\EverTrust\\Horizon\\Generic on windows.\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to write the enrolled certificate to.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to write the enrolled certificate to.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to write the enrolled certificate to.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to write the enrolled certificate to.\n\n --kdb\n\n string\n\n Name of file to write the KDB output to.\n\n --kdb-pwd\n\n ☑ (if using KDB)\n\n string\n\n Password for the KDB output.\n\n --kdb-alias\n\n ☑ (if using KDB)\n\n string\n\n Alias for the KDB output.\n\n --cert\n\n string\n\n Name of the file to write the enrolled certificate to in PEM format.\n\n --key\n\n string\n\n Name of the file to write the enrolled key to.\n\n --der\n\n boolean\n\n Save the certificate and key in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to write the enrolled chain, certificate and key to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --win-user-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n [Windows certificate store] Save the certificate in the windows computer store (LocalMachine).\n\n --win-store-use-tpm\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-use-legacy\n\n boolean\n\n [Windows certificate store] Use the Microsoft Platform Crypto Provider for certificate store storage.\n\n --win-store-set-exportable\n\n boolean\n\n [Windows certificate store] Set the private key as exportable from the certificate store.\n\nStorage output for generic must choose between pfx, certificate, jks or windows store output.\n\n Table 16. Init windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate init --prompt\n\n Enroll a new certificate in the default generic folder\n\n horizon-cli automate init --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Add https to a nginx service\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx\n\n Add https to a nginx service without interaction and with custom SAN values\n\n horizon-cli automate init --automation-policy=<automation policy> --target=nginx --no-interactive --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Control\n\n The control command can take control of an existing certificate on your machine.\n\nThe control command can only be used on known and compliant with Horizon certificates.\nIf the certificate needs to be enrolled, see the other commands to match your use case.\n\n Parameters\n\n Table 17. Control general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --automation-policy\n\n ☑\n\n string\n\n The automation policy to link the certificate to.\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --auto-renew\n\n boolean\n\n Configures a status check every 6 hours.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --analyze-only\n\n boolean\n\n Instead of executing the control, only displays a summary of possible actions.\n\n --no-interactive\n\n boolean\n\n Disables all interactive inputs. All parameters must then be given using cli flags.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 18. Control webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-install\n\n boolean\n\n Disables installation .\n\n --config-folder\n\n string (path to folder)\n\n Explicitly point your webserver configuration folder.\n\n --keystore-password\n\n string\n\n Password of the webserver’s keystore if it cannot be deduced from configuration\n\n Table 19. Control certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 20. Control ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use when renewing\n\n --http-01-port\n\n int\n\n The http 01 port on which to listen\n\n --dns-01-provider\n\n string\n\n DNS provider script to use for ACME enrollments. ACME.sh based on Linux, Posh-ACME based on Windows\n\nFor generic control, it is as of now disabled outside the default folder ( /opt/horizon/var/genric or C:\\ProgramData\\EverTrust\\Horizon\\Generic ) to ensure no service interruption. Use post enrollment scripts to copy the certificate.\n\n Table 21. Control generic options\n\n Parameter\n Mandatory\n Type\n Description\n\n --pfx\n\n string\n\n Name of the PKCS#12 file to control.\n\n --pfx-pwd\n\n string\n\n Password of the PKCS#12 file to control.\n\n --pfx-strength\n\n string\n\n Encryption level for the generated PKCS#12. One of weak , average , strong .\n\n --pfx-alias\n\n string\n\n Alias of the certificate in the PKCS#12 file.\n\n --jks\n\n string\n\n Name of the JKS file to control.\n\n --jks-pwd\n\n string\n\n Password of the JKS file to control.\n\n --jks-alias\n\n string\n\n Alias of the JKS file to control.\n\n --cert\n\n string\n\n Name of the certificate file to control.\n\n --key\n\n string\n\n Name of the key file to control.\n\n --der\n\n boolean\n\n If true, the certificate and key to control are in DER format.\n\n --chain-file\n\n string\n\n Name of the file to write the enrolled certificate chain to.\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n --chain-key-bundle\n\n string\n\n Name of the chain and key bundle file to control.\n\n --win-user-store\n\n boolean\n\n Control the certificate in the windows user store.\n\n --win-computer-store\n\n boolean\n\n Control the certificate in the windows machine store.\n\n --win-thumbprint\n\n boolean\n\n Thumbprint of the certificate to control. To use with --win-computer-store or --win-user-store\n\nInput for generic must choose between pfx, certificate, jks or windows store.\n\n Table 22. Control windows options\n\n Parameter\n Mandatory\n Type\n Description\n\n --win-usages\n\n string array (comma separated)\n\n Windows usages for this certificate. See windows target .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate control --prompt\n\n Control a certificate in the default generic folder\n\n horizon-cli automate control --automation-policy=<automation policy> --target=generic --cert cert.pem --key key.pem --chain-file chain.pem\n\n Control a certificate on an already configured nginx\n\n horizon-cli automate control --automation-policy=<automation policy> --target=nginx\n\n Modify\n\n The modify command allows to select a managed certificate and reenroll it, modifying its sans.\n\nAutomation policy cannot be modified\n\n Parameters\n\n Table 23. Modify general parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --challenge\n\n string array (comma separated)\n\n See challenge section .\n\n --script\n\n string (path to file)\n\n See script section .\n\n --request-challenge\n\n boolean\n\n See challenge section .\n\n --challenge-routine-period\n\n duration\n\n Period of execution of the periodic task.\n\n --user\n\n string\n\n Name of the user to impersonate while running the request challenge periodically.\n\n --discovery-campaign\n\n string\n\n Also add discovery info on the enrolled certificate on the campaign passed.\n\n --prompt\n\n boolean\n\n Enable all interactive inputs. All parameters will now be asked for, except ones given using cli flags.\n\n Table 24. Modify webServer configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --target\n\n string array (comma separated)\n\n List of services to target. If not given, all available services are targeted.\n\n --no-reload\n\n boolean\n\n Do not reload webservers after certificate enrollment.\n\n Table 25. Modify certificate configuration\n\n Parameter\n Mandatory\n Type\n Description\n\n --dn\n\n DN as string, DN elements comma separated.\n\n Requested subject DN. If no CN is specified here, it will be deduced from requested SANs\n\n --dnsnames\n\n string array (comma separated)\n\n List of DNS SANs. If not given, the machine hostname is used.\n\n --ip\n\n string array (comma separated)\n\n List of IP SANs. If not given, no IPs are set.\n\n --labels\n\n string array (comma separated, in label:value form)\n\n Horizon labels to add to the certificate on enrollment.\n\n --team\n\n string\n\n Horizon team to add to the certificate on enrollment\n\n --owner\n\n string\n\n Horizon owner to add to the certificate on enrollment\n\n --contact-email\n\n string\n\n Horizon contact email to add to the certificate on enrollment\n\n Table 26. Modify ACME options\n\n Parameter\n Mandatory\n Type\n Description\n\n --acme-account\n\n ☑ (if using ACME)\n\n string\n\n The identifier (email) of the ACME account to use.\n\n Table 27. Modify Generic options\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --chain-order\n\n string\n\n Order of the chain: root-to-leaf or leaf-to-root .\n\n Examples\n\n Use the interactive mode\n\n horizon-cli automate modify --prompt\n\n Set sans for the generic certificates\n\n horizon-cli automate modify --target=generic --dnsnames=\"nginx.test,*.test\" --ip \"1.1.1.1\"\n\n Edit\n\n The edit command allows to change automation data on managed certificates.\n\n Parameters\n\n Table 28. Edit selection parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --ids\n\n string array (comma separated)\n\n Identifiers of the services to edit. Supports glob syntax\n\n --serials\n\n string array (comma separated)\n\n Serial numbers of the certificates to edit all its services\n\n Table 29. Edit state parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --no-install\n\n boolean\n\n Change the no-install value for targeted services\n\n Backup\n\n Each time a file is replaced by the Horizon Client, the old file is backed up. The backup files are stored in the cert/backup/<HASH(BACKUPED FILE PATH)> directory relative to the Horizon Client data folder ( /opt/horizon on unix and C:/ProgramData/EverTrust/Horizon on Windows), as filename_n.ext where n is the number of the backup. Thus, the filename_0.ext is the original version, before any intervention of the Horizon Client.\n\n Internal Database operations\n\n The internal database is used to store the details of the certificates that are discovered and enrolled by the automation module. You can list them using the automate list command, and delete them using the automate delete command. Certificates are indexed by their bindings, which are the combination of all the services along with the hostnames and ports that use the certificate. For example, if you have a certificate that is used by Apache for all hosts on the port 443, it’s \"id\" in the local database will be apache-*:443 .\n\n You can choose the output format of the automate list command.\nBy default, it outputs a string, but you can use the --json option to output a JSON object. example:\n\n horizon-cli automate list --json | jq\n\n The automate remove --ids <id1>, …​, <idn> command erases certificates from the local database.\nThis command will not remove the certificate files from your machine, only remove it from the \"managed certificates\" local database.\nThis way, the client will not check its status at each routine execution anymore.\n\n You can use the automate remove --ids all command to remove all certificates from the local database.\n\n To select certificates to remove, another option is to use the --serials option with the serials of the certificates to remove.\n\n The --restore option of the automate remove command can be used to restore a certificate from a backup file.\nThe backup file to be restored will always be the older one, in most cases the filename_0.ext , that is, the original file before any tampering by the Horizon Client.\nFor certificates stored in the Windows store, the store thumbprints will be stored in a file corresponding to the server type, like iisbackups .\n\n The --revoke option of the automate remove command can be used to revoke the certificate after being removed from the \"managed certificate\" local database.\nYou can add the option --reason to specify the revocation reason of the certificate.\n\n System commands\n\n horizon-cli uses system commands to manage webservers. In order to use them with sudo , the SUDO_COMMANDS configuration is available and the commands that might be executed on each flow are available below (linux only):\n\n apache\n\n systemctl\n\n apachectl\n\n a2enmod\n\n a2dismod\n\n which\n\n whereis\n\n ln\n\n bash for script execution\n\n nginx\n\n systemctl\n\n nginx\n\n ln\n\n bash for script execution\n\n tomcat\n\n systemctl\n\n bash for script execution\n\n lighttpd\n\n systemctl\n\n ln\n\n bash for script execution\n\n wildfly\n\n systemctl\n\n bash for script execution\n\n generic\n\n bash for script execution\n\n haproxy\n\n systemctl\n\n haproxy\n\n bash for script execution\n\n Routine\n\n Table 30. Routine arguments\n\n Argument\n Mandatory\n Type\n Description\n\n automation-policies\n\n string array (comma separated)\n\n List of automation policies to check for certificate renewal. If not given, all policies are checked.\n\n Its usage is described in the renewal section .\n\n Management commands\n\n Periodic task\n\n To run the routine at specified intervals, the periodic task command can create scheduled execution on windows (scheduled task) and linux (cron).\n\n Two commands are available, to remove and add the task.\n\n Parameters\n\n Table 31. Create periodic task arguments\n\n Argument\n Mandatory\n Type\n Description\n\n Period\n\n duration\n\n Run the routine command every period from midnight UTC. Must be superior to 1h and inferior to 24h. Defaults to 6h.\n\n Table 32. Create periodic task parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --user\n\n string\n\n Linux only : The user to impersonate while running the routine. Defaults to root user.\n\n Examples\n\n Create a periodic task to run routine every 7h\n\n horizon-cli automate create-periodic-task 7h\n\n Remove the periodic task\n\n horizon-cli automate remove-periodic-task\n\n List\n\n The list command lists the currently managed certificates and various information about them, notably the associated automation policy.\n\n Parameters\n\n Table 33. List parameters\n\n Parameter\n Mandatory\n Type\n Description\n\n --json\n\n string\n\n Output the current state as JSON instead of human readable format.\n\n Examples\n\n Show the currently managed certificates\n\n horizon-cli automate list\n\n Show the currently managed certificates as JSON\n\n horizon-cli automate list --json\n\n Remove\n\n The remove command erases a certificate binding from the horizon-cli managed certificates.\n\n Parameters\n\n Table 34. Remove parameters\n\n Parameter\n\n Mandatory\n\n Type\n\n Description\n\n --ids\n\n string list\n\n Ids of the services to remove. See automate list to get the id. Use all to erase every managed certificate.\n\n --serials\n\n string list\n\n Serials of the certificates to remove. All linked services will be removed. See automate list to get the serial.\n\n --restore\n\n boolean\n\n Enables restoration of the oldest backup for the removed certificate.\n\n --revoke\n\n boolean\n\n Enables the revocation of the removed certificate\n\n --reason\n\n string\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n --acme-account\n\n ☑ (if revoking ACME certificate)\n\n string\n\n The identifier (email) of the ACME account to use\n\n Examples\n\n Remove all currently managed certificates\n\n horizon-cli automate remove --ids all\n\n Remove the certificate linked to nginx https and restore the original one\n\n horizon-cli automate remove --ids nginx-*:443 --restore\n\n Remove and revoke the certificate linked to nginx https one\n\n horizon-cli automate remove --ids nginx-*:443 --revoke --reason affiliationchanged\n\n Examples\n\n Enroll certificates used by nginx and apache\n\n horizon-cli automate enroll \\\n --target=nginx,apache \\\n --automation-policy=<POLICY_NAME>\n\n Enroll certificates using the generic target\n\n horizon-cli automate enroll \\\n --target=generic \\\n --automation-policy=<POLICY_NAME>\n\n Use the interactive mode\n\n horizon-cli automate enroll --prompt\n\n Check if the previously enrolled certificates need to be renewed\n\n horizon-cli automate routine\n\n Get the DN of all the certificates enrolled by the automation module\n\n horizon-cli automate list --json | jq -r '.[] | .certificate | .subject'\n\n Remove the certificate used by nginx on the port 443 from the automatically renewed certificates\n\n horizon-cli automate remove --ids nginx-*:443\n\n Remove the certificate used by tomcat on the port 8443 from the automatically renewed certificates and restore the original certificate\n\n horizon-cli automate remove --restore --ids tomcat-*:8443\n\n Bulk Operations\n Horizon-cli 1.16.0 release notes", + "keywords": [ + "automation", + "html", + "horizon", + "client", + "automatic", + "tls", + "certificate", + "installation" + ] + }, + { + "page_id": "horizon-cli:1.16:basic.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Basic commands", + "section": "basic.html", + "slug": "basic.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/basic.html", + "breadcrumbs": ["Horizon Client", "Basic commands"], + "summary": "Basic commands Ping The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server. horizon-cli ping The --permissions flag will display ", + "content": "Basic commands\n\n Ping\n\n The Ping command can be useful to ensure the client configuration to access Horizon is correct. It will exit in error if the client could not join the Horizon server.\n\n horizon-cli ping\n\n The --permissions flag will display the permissions associated with the account the client is using, or if it is not, it will log a message indicating it.\n\n horizon-cli ping --permissions\n\n General Configuration and Usage\n Discovery Operations", + "keywords": ["basic", "commands", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:bulk.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Bulk operations", + "section": "bulk.html", + "slug": "bulk.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", + "breadcrumbs": ["Horizon Client", "Bulk Operations"], + "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", + "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", + "keywords": ["bulk", "operations", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:config.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "General Configuration and Usage", + "section": "config.html", + "slug": "config.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", + "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], + "summary": "General Configuration and Usage Installation Package install/uninstall Installing the package RPM Windows Binary Installing from the Evertrust repository Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository in", + "content": "General Configuration and Usage\n\n Installation\n\n Package install/uninstall\n\n Installing the package\n\n RPM\n\n Windows\n\n Binary\n\n Installing from the Evertrust repository\n\n Create a /etc/yum.repos.d/horizon-cli.repo file containing the EverTrust repository info:\n\n [horizon-cli]\nenabled=1\nname=Horizon Client Repository\nbaseurl=https://repo.evertrust.io/repository/horizon-cli-rpm/\ngpgcheck=1\ngpgkey=https://evertrust.io/.well-known/rpm/gpg.pub\nusername=<username>\npassword=<password>\n\n Replace <username> and <password> with the credentials you were provided.\n\n Make sure the Evertrust GPG key is trusted:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n You can then run the following to install the latest Horizon Client version:\n\n # yum install horizon-cli\n\n To prevent unattended upgrades when running yum update, you should pin the Horizon Client version by adding\n\n exclude=horizon-cli\n\n at the end of the /etc/yum.repos.d/horizon-cli.repo file after installing Horizon Client.\n\n Installing from the package file\n\n Download the latest RPM for Horizon Client on the Official EVERTRUST repository .\n\n Upload the file ' horizon-cli-<latest>.x86_64.rpm ' to the server;\n\n Access the server with an account with administrative privileges;\n\n Install the Horizon Client package with the following command:\n\n # yum localinstall /root/horizon-cli-<latest>.x86_64.rpm\n\n If you wish to verify the signature of the RPM package, the EVERTRUST key can be added to your trusted keys using the following command:\n\n # rpm --import https://evertrust.io/.well-known/rpm/gpg.pub\n\n The signature can then be verified using the following command:\n\n # rpm -K /root/horizon-cli-<latest>.x86_64.rpm\n\n To install the package, double click on the MSI file and follow the instructions.\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the PATH , in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n # chmod +x horizon-cli.bin\n\n Uninstalling the package\n\n RPM\n\n Windows\n\n Binary\n\n # yum remove horizon-cli\n\n To uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Remove the binary file from your system, and remove it from PATH\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n $ horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n $ horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration Location\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n Global configuration :\n\n /opt/horizon/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n Per-user configuration :\n\n ~/.horizon-cli/etc/horizon-cli.conf\n\n [C|D]:\\Users\\<username>\\AppData\\Local\\horizon-cli\\horizon-cli.conf\n\n In case the user running the Horizon Client is an administrator and the global configuration file is present and accessible by the user, the global configuration file will be used. Otherwise, the per-user configuration file will be used.\n\n If the per-user configuration file is not present and the global configuration file is not accessible, the client will throw an error.\n\n Configuration Content\n\nSince version 1.10 , the configuration was migrated from JSON to YAML, if you are upgrading from an earlier version, the configuration migration will be done automatically and should be seamless.\n\n The configuration file is in YAML format and contains the following:\n\n api_id: API-ID\n api_key: API-Key\n endpoint: endpoint url. e.g. https://horizon-test.evertrust.fr\n debug: false\n timeout: 2\n proxy: proxy. e.g. http://myproxy.corp.local:3128\n root_ca: Root CA PEM Certificate(s).\n log_file: The log file of Horizon.\n external_proxy: proxy. e.g. http://myproxy.corp.local:3128\n sudo_commands:\n - command_one\n - another_command\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n HRZ_APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n HRZ_APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n HRZ_ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n HRZ_DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n HRZ_HTTPS_PROXY\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n HRZ_LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n external_proxy\n\n HRZ_EXTERNAL_PROXY\n\n HTTPS proxy used to reach Third Parties (if any), in URL form which can contain login and password if needed.\n\n sudo_commands\n\n HRZ_SUDO_COMMANDS\n\n Array of commands that should be executed using sudo.\n\n Configuration customization\n\n Changing the configuration file location\n\n In case you want to change the configuration file location, the HRZ_CONFIG environment variable can contain an absolute path to the configuration file and will try to read it before defaulting to the standard configuration as detailed above.\n\n Changing all horizon-client files location\n\n Additional files are used by the client (automation state, log files, etc). In case you want to change the path to these configurations, the HRZ_LOCAL_DATA environment variable can contain an absolute path to a folder, and will create all necessary files starting from this folder.\n\nIn order to keep backward compatibility, legacy environment variables are still available and are the same as the one above without the HRZ_ prefix. These should not be used and should be migrated to HRZ-prefixed one.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n $ horizon-cli <command> <subcommand> --help\n\n Requirements\n Basic commands", + "keywords": [ + "general", + "configuration", + "and", + "usage", + "config", + "html", + "horizon", + "client" + ] + }, + { + "page_id": "horizon-cli:1.16:discovery.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Discovery Operations", + "section": "discovery.html", + "slug": "discovery.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", + "breadcrumbs": ["Horizon Client", "Discovery Operations"], + "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", + "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\nWhen detecting a path to a certificate file containing an environment variable, a warning event with code HCL-LOCALSCAN-ENV-001 will be raised\n\n Keystores\n\n To handle keystores, the --containers-passwords option allows to specify keystore passwords to try on encountered keystore.\n\nWhen a keystore cannot be opened, a warning event with code HCL-LOCALSCAN-KS-001 will be raised\n\n Scheduling\n\n In order to perform local scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli localscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli localscan --campaign=test --remove-periodic-task\n\n Scanned folders\n\n By default, localscan will scan these commonly used paths:\n\n On Unix: /usr/local/etc , /etc and /opt\n\n On Windows: user store , machine store , program data , program files , program files x86\n\n To disable scanning these paths, use the --exclude-default-paths option.\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n If you wish to also scan the TLS versions and supported cipher suites of the scanned ports, you can use the --scan-supported-tls option.\n\n Due to technical limitations in the GO runtime, some cipher suites cannot be tested.\n\n The recommended approach is to import an nmap scan using nmap import .\n\n Supported cipher suites\n\n TLS_AES_128_GCM_SHA256\n\n TLS_AES_256_GCM_SHA384\n\n TLS_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\n\n TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n\n TLS_RSA_WITH_RC4_128_SHA\n\n TLS_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA\n\n TLS_RSA_WITH_AES_256_CBC_SHA\n\n TLS_RSA_WITH_AES_128_CBC_SHA256\n\n TLS_RSA_WITH_AES_128_GCM_SHA256\n\n TLS_RSA_WITH_AES_256_GCM_SHA384\n\n TLS_ECDHE_ECDSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_RC4_128_SHA\n\n TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA\n\n TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256\n\n TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\n\n Source : https://go.dev/src/crypto/tls/cipher_suites.go\n\n horizon-cli netscan --campaign=test --scan-supported-tls\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n If the ssl-enum-ciphers was also used on the scan, the TLS ciphers for the certificates will also be sent to Horizon.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n Tenable.sc Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Tenable.sc into Horizon.\n\n To utilize this feature, you need to ensure that you have valid credentials for Tenable.sc with the necessary permissions to access and export scan data and the scan name on which you want to perform the import. Additionally, you must know your Tenable.sc hostname through which Horizon Client will communicate with the Tenable.sc API and use the \"SSL Certificate Information\" plugin output to get the certificates into Horizon.\n\n horizon-cli importscan tenable-sc --campaign=<campaign> --scan-name=<name of the scan> --hostname=<tenable.sc instance>\n\n Basic commands\n Import operations", + "keywords": ["discovery", "operations", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:est.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "EST Certificate Lifecycle Operations", + "section": "est.html", + "slug": "est.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", + "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], + "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", + "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", + "keywords": [ + "est", + "certificate", + "lifecycle", + "operations", + "html", + "horizon", + "client" + ] + }, + { + "page_id": "horizon-cli:1.16:import.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Import Operations", + "section": "import.html", + "slug": "import.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", + "breadcrumbs": ["Horizon Client", "Import operations"], + "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", + "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certificates --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\nThis feature requires the use of an administrator account on the F5 BIG-IP instance.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Global Options\n\n --login-provider specifies the login provider to use for TACACS to connect to the BIG-IP instance\n\n IControl Options\n\n --partition specifies the F5 partition to retrieve the certificates from\n\n --merge-third-party enables fine tracking of the certificate across multiple SSL profiles. Enable this flag only with Horizon version superior or equal to 2.7.18\n\n AS3 Options\n\n --as-3 enables AS3 compatibility\n\n --filter-globs is a list of globs to filter the certificates to import, based on the JSON path in the AS3 configuration\n\n Akamai CPS\n\n You can import all your valid certificates from Akamai Certificate Provisioning System. To do so, authentication credentials are required.\n\n horizon-cli netimport akamai --campaign=test --host=<Akamai hostname> --client-secret=<client secret> --client-token=<client token> --access-token=<access token>\n\n Gandi\n\n You can import all your valid certificates from Gandi. To do so, authentication credentials are required.\n\n horizon-cli netimport gandi --campaign=test --access-token=<access token>\n\n HashiCorp Vault\n\n You can import all your certificates from HashiCorp Vault. The secret engines containing your certificates must be specified using the --secrets-engines option.\n\n The required permissions for the scan operation are:\n\n path \"<engine>/certs/*\" {\n capabilities = [\"read\", \"list\"]\n}\n\n As of the current version, both Token and AppRole authentication are supported. If another authentication method is required, a Token can be retrieved using Vault APIs and then used for the scan.\n\n horizon-cli netimport vault --campaign=test --token=<token> --secrets-engines pki\n\n Nameshield\n\n You can import all your certificates from Nameshield certificates.\n\n horizon-cli netimport nameshield --campaign=test --token=<token>\n\n Panorama\n\n You can import all your certificates from PaloAlto Panorama.\n\n The required permissions for the scan operation are:\n\n XML API: Configuration\n\n horizon-cli netimport panorama --campaign=test --api-key=<api key> --hostname <panorama host>\n\nBy default, only the certificates deployed on the panorama (internal config and templates) will be scanned. If you wish to also scan each device managed by the panorama, use the --scan-devices option. If you do so, the Operational Requests permission must be added to the service account.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", + "keywords": ["import", "operations", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:introduction.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Introduction", + "section": "introduction.html", + "slug": "introduction.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", + "breadcrumbs": ["Horizon Client", "Introduction"], + "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", + "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n For system and operating system requirements, please refer to the Requirements page.\n\n This document is specific to Horizon Client version 1.16 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n Requirements", + "keywords": ["introduction", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:release-notes:1.16.0", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Horizon-cli 1.16.0 release notes", + "section": "release-notes", + "slug": "release-notes/1.16.0", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.0.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/release-notes/1.16.0.html", + "breadcrumbs": [ + "Horizon Client", + "Release notes", + "Horizon-cli 1.16.0 release notes" + ], + "summary": "Horizon-cli 1.16.0 release notes Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-9", + "content": "Horizon-cli 1.16.0 release notes\n\n Here are the release notes for EverTrust Horizon Client v1.16.0, released on 2026-04-13.\nFor the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-923] - All enrollment commands now support a --dn flag to specify the full Subject DN, enabling use of additional DN attributes such as DC.\n\n [HOR-939] - Ensured Windows Server 2025 support.\n\n [HOR-970] - Panorama discovery is now supported in the netimport section.\n\n [HOR-972] - Tenable.sc is now supported as a scan import source in the importscan section.\n\n [HOR-996] - A new --update flag is now available for protocol enrollment commands, allowing JKS and KDB keystores to be updated in place rather than overridden.\n\n [HOR-1019] - A new HRZ_LOCALDB environment variable is now supported to configure an alternative configuration directory.\n\n [HOR-1021] - A new horizon-cli automate edit command is now available to modify certificate options in the client internal state.\n\n [HOR-809] - A new --generic-windows-archival flag is now available on horizon-cli install to control whether outdated certificates are removed from the Windows store after renewal. This is to ensure compatibility with pre 1.11 versions.\n\n 2. Enhancements\n\n [HOR-1024] - horizon-cli automate list now displays certificates deleted outside the CLI as \"Could not retrieve\" instead of failing, and horizon-cli automate remove now supports removing such entries from state.\n\n [HOR-1140] - TLS ciphers reported by the NMAP ssl-enum-ciphers script are now parsed and displayed in Horizon scan results.\n\n [HOR-754] - IP SANs are now displayed alongside DNS SANs in horizon-cli automate list output.\n\n [HOR-78] - The --scan-tls flag is now available in netscan to test all TLS versions supported by an endpoint.\n\n 3. Bug Fixes\n\n [HOR-882] - Fixed an issue where EC certificates were not retrieved during an F5 netimport.\n\n [HOR-1017] - Fixed an issue where horizon-cli webra enroll returned unclear error messages when using a non-existent profile or a profile with a manual password policy.\n\n 4. Reworked features\n\n [None]\n\n 5. Known Defects\n\n [None]\n\n Automatic TLS Certificate Installation", + "keywords": [ + "horizon-cli", + "16", + "release", + "notes", + "release-notes", + "release-notes/1", + "horizon", + "client" + ] + }, + { + "page_id": "horizon-cli:1.16:requirements.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Requirements", + "section": "requirements.html", + "slug": "requirements.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/requirements.html", + "breadcrumbs": ["Horizon Client", "Requirements"], + "summary": "Requirements Requirements System requirements To run Horizon Client the underlying system must comply with the following minimum requirements : For certificate lifecycle purposes 1 gigahertz (GHz) or faster with 1 or more cores 1 gigabyte (", + "content": "Requirements\n\n Requirements\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n Operating system requirements\n\n The following elements are considered as operating system requirements:\n\n AIX (64-bit);\n\n Linux (64-bit);\n\n Microsoft Windows 10 (64-bit);\n\n Microsoft Windows Server 2016 (64-bit);\n\n Microsoft Windows Server 2019 (64-bit);\n\n Microsoft Windows Server 2022 (64-bit);\n\n Microsoft Windows Server 2025 (64-bit);\n\n Introduction\n General Configuration and Usage", + "keywords": ["requirements", "html", "horizon", "client"] + }, + { + "page_id": "horizon-cli:1.16:scep.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "SCEP Certificate Lifecycle Operations", + "section": "scep.html", + "slug": "scep.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", + "breadcrumbs": [ + "Horizon Client", + "SCEP Certificate Lifecycle Operations" + ], + "summary": "SCEP Certificate Lifecycle Operations The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode. Usage: horizon-cli scep [co", + "content": "SCEP Certificate Lifecycle Operations\n\n The Horizon Client includes a SCEP client to perform challenge based pre-validated enrollments and renewals. Its usage is similar to that of the EST client in challenge mode.\n\n Usage:\n\n horizon-cli scep [command] [flags]\n\n SCEP Enrollment\n\n The enroll command allows you to perform a SCEP enrollment operation. It will generate a new key pair and a CSR based on the content parameters, and send it to the SCEP server to obtain a certificate.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Challenge password in decentralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the SCEP profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli scep enroll --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the SCEP profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the SCEP request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli scep enroll --challenge=<challenge> --profile=test --dn=CN=TestCN [data parameters] [key and certificate parameters]\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n SCEP Renewal\n\n The renew command is designed to work similarly to the enroll command, but with a few differences:\n\n It will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters. Only the --key-type parameter is used to generate a new key pair.\n\n No challenge is needed for a SCEP renewal operation\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for SCEP enrollment in various context\n\n Enrollment with output as key and certificate\n\n horizon-cli scep enroll --profile=<profile> --challenge=<challenge> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Enrollment with lots of metadata and output as PKCS#12\n\n horizon-cli scep enroll \\\n --profile=<profile> \\\n --challenge=<challenge> \\\n --key-type=rsa-2048 \\\n --dn=CN=test.example.com,OU=it \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n Renewal with output as key and certificate\n\n horizon-cli scep renew --profile=<profile> --in-cert /path/to/cert --cert=/path/to/cert --key=/path/to/key\n\n EST Certificate Lifecycle Operations\n WebRA Certificate Lifecycle Operations", + "keywords": [ + "scep", + "certificate", + "lifecycle", + "operations", + "html", + "horizon", + "client" + ] + }, + { + "page_id": "horizon-cli:1.16:update.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "Update operations", + "section": "update.html", + "slug": "update.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", + "breadcrumbs": ["Horizon Client", "Updating a certificate"], + "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", + "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", + "keywords": [ + "update", + "operations", + "html", + "horizon", + "client", + "updating", + "certificate" + ] + }, + { + "page_id": "horizon-cli:1.16:webra.html", + "product": "horizon-cli", + "kind": "companion", + "source": "antora", + "version": "1.16", + "title": "WebRA Certificate Lifecycle Operations", + "section": "webra.html", + "slug": "webra.html", + "url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", + "breadcrumbs": [ + "Horizon Client", + "WebRA Certificate Lifecycle Operations" + ], + "summary": "WebRA Certificate Lifecycle Operations The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation. WebRA operations validation Like SCEP and EST,", + "content": "WebRA Certificate Lifecycle Operations\n\n The Horizon Client can perform post-validated lifecycle operations using the WebRA protocol. This includes certificate enrollment, renewal and revocation.\n\n WebRA operations validation\n\n Like SCEP and EST, WebRA operations requires the intervention of a third party to validate the request. Unlike SCEP and EST though, it is a post-validation protocol, meaning that no challenge is produced before the operation, instead a request is created and sent to the WebRA server, which will need to be validated or cancelled by an operator with the appropriate rights on the web app.\n\n This means the Horizon Client performs enrollment and renewal operations in two steps:\n\n Create the request\n\n Once the request is validated, retrieve the certificate\n\n Depending on the time it takes for the request to be validated, the Horizon Client can be configured to either enter a blocking loop and wait for the request to be validated, or merely create the request and exit.\n\n If the latter is chosen, the Horizon Client will keep in its internal database the pending request, and will check for its validation each time the horizon-cli automate routine command is executed. If the request is validated, the certificate will be retrieved and stored in the appropriate location. If it is denied, the request will be removed from the database. In some cases you would want to configure a crontab or scheduled task to perform this check periodically. You can use the command horizon-cli automate create-periodic-task <period> to help you in the process, or create it manually.\n\n By default, the behavior is to create the request and exit. If you wish for the client to enter a blocking loop until the request is validated, specify the --now flag.\n\n WebRA Enrollment\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Certificate parameters\n\n Table 2. Data parameters\n\n Parameter\n\n Description\n\n --dn\n\n Requested subject DN. Single value. DN elements comma separated.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n --ms-guid\n\n Requested Microsoft GUID. Single value\n\n --ms-sid\n\n Requested Microsoft SID. Single value\n\n Table 3. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 4. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 5. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 6. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Renewal\n\n The webra renew command is designed to work similarly to the webra enroll command, except that it will enroll a certificate based on the --in-cert parameter (or similar, see below) instead of the content parameters.\n\n General renewal parameters\n\n Table 7. General parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --now\n\n Start a blocking loop to wait for request approval\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 8. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n --in-kdb-pwd\n\n Password for the KDB file to renew\n\n --in-kdb-alias\n\n Alias for the KDB file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 9. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --kdb\n\n Path to write the KDB output\n\n --kdb-pwd\n\n Password for the KDB output. Mandatory if --kdb is set\n\n --kdb-alias\n\n Alias for the KDB output. Mandatory if --kdb is set\n\n --overwrite\n\n Always overwrite existing files\n\n --update\n\n Update keystores when they already exist (JKS, KDB)\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 10. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n WebRA Import\n\n The `webra import`command is designed to import a certificate and its key on a profile.\n\n Import parameters\n\n Table 11. WebRA import parameters\n\n Parameter\n\n Description\n\n --profile\n\n Existing profile on which to import\n\n Table 12. Metadata parameters\n\n Parameter\n\n Description\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --contact-email\n\n Contact email of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n --metadata\n\n Technical metadata of the imported certificate, in key:value form\n\n Input parameters\n\n These parameters define how to find the certificate to import. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 13. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to import (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to import if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to import\n\n --in-jks-pwd\n\n Password for the JKS file to import\n\n --in-jks-alias\n\n Alias for the certificate to import in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to import\n\n WebRA Revocation\n\n The webra revoke command takes the following parameters:\n\n Revocation parameters\n\n Define how to revoke this certificate:\n\n Table 14. WebRA revocation parameters\n\n Parameter\n\n Description\n\n --reason\n\n Reason for revocation ( unspecified , keycompromise , cacompromise , affiliationchanged , superseded , cessationofoperation )\n\n Input parameters\n\n These parameters define how to find the certificate to revoke. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Table 15. WebRA input certificate parameters\n\n --in-cert\n\n Path to the Certificate to revoke (PEM file, PKCS#12 file, JKS file) or cert thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to revoke if it is not included in the certificate file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to revoke\n\n --in-jks-pwd\n\n Password for the JKS file to revoke\n\n --in-jks-alias\n\n Alias for the certificate to revoke in the JKS file\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to revoke\n\n For a revocation operation, the --now flag is unavailable, and the automate routine command will not track the revocation status, as no actions are to be performed after the revocation is complete. This command thus merely creates the revocation request and exits.\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for WebRA enrollment in various context\n\n Enrollment with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra enroll --profile=<profile> --dn=CN=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key --now\n\n Enrollment with lots of metadata, output as PKCS#12 and no blocking loop\n\n horizon-cli webra enroll \\\n --profile=<profile> \\\n --dn=CN=test.example.com \\\n --dnsnames=test.example.com,www.test.example.com \\\n --owner=\"John Doe\" \\\n --ou=\"IT\" \\\n --team=\"IT\" \\\n --labels=\"env:prod\" \\\n --pfx=/path/to/pkcs12 \\\n --pfx-pwd=<pkcs12_password>\n\n after this command, run periodically:\n\n horizon-cli automate routine > /path/to/my/logfile\n\n Renewal with output as key and certificate, waiting for the certificate to be issued\n\n horizon-cli webra renew --in-cert /path/to/old/cert --in-key /path/to/old/key --cert /path/to/cert --key /path/to/key --now\n\n Revocation of a certificate\n\n horizon-cli webra revoke --in-cert /path/to/cert --in-key /path/to/key\n\n SCEP Certificate Lifecycle Operations\n Updating a certificate", + "keywords": [ + "webra", + "certificate", + "lifecycle", + "operations", + "html", + "horizon", + "client" + ] + }, { "page_id": "horizon-cli:1.5:automation.html", "product": "horizon-cli", @@ -2568,7 +2875,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -2596,7 +2903,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allow to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update the bulk update command allow update of certificate metadata en masse. The command takes a ", "content": "Bulk operations\n\n The horizon client allow to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n the bulk update command allow update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team and the labels of the certificates.\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --label\n\n The label, in the forme key:value, to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --label \"mylabel:myvalue\"\n\n Bulk migrate\n\n The bulk migrate command allow certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata.\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --label\n\n The label, in the forme key:value, to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --label mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allow certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n EST Certificate Lifecycle Operations\n Automatic TLS Certificate Installation", @@ -2612,7 +2919,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage General parameters of Horizon Client are configured through a file placed in one of the following locations: /opt/horizon/etc/horizon-cli.conf /usr/local/etc/horizon-cli.conf [C|D]:\\ProgramData\\EverTrust\\Hori", "content": "General Configuration and Usage\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": true,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n Finally, Horizon Client is designed to output informative messages on STDOUT and logs on STDERR. Thus, a typical command line to launch Horizon Client will look the following:\n\n horizon-cli <command> <parameters> 2>horizon-cli.log\n\n You can use the “--help” parameter to get online help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", @@ -2637,7 +2944,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n General Configuration and Usage\n Import operations", @@ -2653,7 +2960,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est --enroll=static --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n horizon-cli est --enroll=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n horizon-cli est --enroll=cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est --enroll=cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “--renewal” parameter. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est --renew --profile=test --key=/path/to/key --cert=/path/to/cert [key and certificate parameters]\n\nhorizon-cli est --renew --profile=test ---win-store-auth --cn=TestCN [key and certificate parameters]\n\n Revocation\n\n The certificate revocation is performed using the “--revoke” parameter, and used the APIID and APIKEY provided in the general configuration to authenticate to Horizon.\nThis means the user identified by the APIID parameter must have revocation rights on the certificate to revoke.\n\n horizon-cli est --revoke --cert=/path/to/cert\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfxpwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --export-jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --export-jks\n\n --jks-key-password\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpdw, only used with --export-jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/p12 --pfxpwd=<pkcs12_password>\n\n You need to specify --key and --cert options, because you will need key and cert separately later on to trigger renewal\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --centralized\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/p12 --pfxpwd=<pkcs12_password> --centralized\n\n You need to specify --key and --cert options, because you will need key and cert separately later on to trigger renewal\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est --enroll=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal, output as key and certificate\n\n horizon-cli est --renew --profile=<profile> --key=/path/to/key --cert=/path/to/cert\n\n Decentralized renewal using machine windows store\n\n horizon-cli est --renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n Bulk Operations", @@ -2677,7 +2984,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<PKCS#12 password>\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -2693,7 +3000,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.5/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n This document is specific to Horizon Client version 1.5 , which may be used with EverTrust Horizon 2.2.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery\n\n Certificate import\n\n Certificate lifecycle management\n\n General Configuration and Usage", @@ -2736,7 +3043,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -2764,7 +3071,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -2780,7 +3087,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Command line installation Use the command below to install the client and generate interactively your configuration file: horizon-cli install The configuration file can also be created using command line para", "content": "General Configuration and Usage\n\n Command line installation\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get online help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", @@ -2805,7 +3112,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n General Configuration and Usage\n Import operations", @@ -2821,7 +3128,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --mode=static --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n horizon-cli est enroll --mode=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n horizon-cli est enroll --mode=cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --mode=cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew --key=/path/to/key --cert=/path/to/cert [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN --win-store-save [key and certificate parameters]\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon in Enroll mode.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used to be used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --jks\n\n --jks-alias-pwd\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpwd, only used with --jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --centralized\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfxpwd=<pkcs12_password> --centralized\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --mode=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --key=/path/to/new/key --cert=/path/to/new/cert\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --key=/path/to/key --cert=/path/to/cert\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n ACME Certificate Lifecycle Operations", @@ -2845,7 +3152,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<PKCS#12 password>\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -2861,7 +3168,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n This document is specific to Horizon Client version 1.6 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery\n\n Certificate import\n\n Certificate lifecycle management\n\n General Configuration and Usage", @@ -2877,7 +3184,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -2904,7 +3211,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. The update-cert command need the 'Update (pop)' c", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\nThe update-cert command need the 'Update (pop)' common configuration permission enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Input parameters\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the Certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries.\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various context\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --key=/path/to/key --cert=/path/to/cert --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -2928,7 +3235,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.6/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -2982,7 +3289,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -3010,7 +3317,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n --metadata\n\n The metadata to set on certificates matching the query. (Optional)\n\n # horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n --metadata\n\n The metadata to set on certificates matching the query. (Optional)\n\n # horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --reason\n\n Reason for revocation. Default is \"unspecified\"\n\n # horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -3026,7 +3333,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package # yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package # yum remove horizon-cli Using MSI file: To insta", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n # yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n # yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n # chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n # horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n # horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n # horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", @@ -3051,7 +3358,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n # horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n # horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n # horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n The created task can then be removed using:\n\n # horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n # horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n # horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n General Configuration and Usage\n Import operations", @@ -3067,7 +3374,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n # horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n # horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n # horizon-cli est enroll --auth-cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\n# horizon-cli est enroll --auth-cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n # horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\n# horizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon in Enroll mode.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --jks\n\n --jks-alias-pwd\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpwd, only used with --jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n # horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n # horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n # horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n # horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n # horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n # horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n # horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n # horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n ACME Certificate Lifecycle Operations", @@ -3091,7 +3398,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n # horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n # horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n # horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n # horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n # horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n # horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n # horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n # horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -3107,7 +3414,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n This document is specific to Horizon Client version 1.7 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n General Configuration and Usage", @@ -3291,7 +3598,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -3318,7 +3625,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. The update-cert command need the 'Update (pop)' c", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\nThe update-cert command need the 'Update (pop)' common configuration permission enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Input parameters\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the Certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries.\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various context\n\n Updating the owner of a certificate\n\n # horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n # horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n # horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -3342,7 +3649,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.7/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -3396,7 +3703,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -3424,7 +3731,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -3440,7 +3747,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", @@ -3465,7 +3772,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n General Configuration and Usage\n Import operations", @@ -3481,7 +3788,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported: Static and authorized user/password in decentralized mode Stat", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates. The following enrollment modes are supported:\n\n Static and authorized user/password in decentralized mode\n\n Static and authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Static and authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in \"authorized\" mode thus a static username and password can be provided to Horizon Client for enrollment. They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to \"challenge\" mode. A request must then be made on Horizon in order to retrieve the one-time password \"challenge\" to be used to authenticate the EST request. No APIID nor APIKEY need to be set.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to \"x509\" mode. The client is then able to make a request to Horizon by authenticating with an existing certificate. This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n horizon-cli est enroll --auth-cert --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --auth-cert --profile=test ---win-store-auth --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR. The CSR is generated according to Data parameters , and the private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR. The CSR is generated according to Data parameters . The private key generated by Horizon Client is discarded. A random password is generated and inserted into the CSR. If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password. The retrieved private key and the retrieved certificate are then stored according to the Key and Certificate parameters\n\n The random password generated has 16 characters, letters and numbers. If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command. It works the same way as the Certificate swap mode, except that:\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n Data parameters\n\n These parameters are used to be inserted in the Certificate Signing Request sent to Horizon in Enroll mode.\n\n Table 1. CSR data parameters\n\n Parameter\n Description\n\n --cn\n\n Requested subject Common Name, single value, and mandatory.\n\n --ou\n\n Requested subject OU . Can contain multiple values. Optional.\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values. Optional.\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values. Optional.\n\n Key and Certificate parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server.\n\n Table 2. Platform-independent key and certificate parameters\n\n Parameter\n Description\n\n --key\n\n Path to the private key to store\n\n --cert\n\n Path to the certificate to store\n\n --pfx\n\n Path to the PKCS#12 file storing the certificate and its key\n\n --pfx-pwd\n\n Password used to encrypt the PKCS#12 file specified in the --pfx parameter\n\n --jks\n\n Path to export the certificate and private key as JKS. Optional, must be used along pfx/pfxpwd options as pfxpwd option is used to protect the JKS\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias of the private key entry within the JKS. Optional, only used with --jks\n\n --jks-alias-pwd\n\n Password of the private key entry within the JKS. Optional, defaults to pfxpwd, only used with --jks\n\n Table 3. Windows-only key and certificate parameters\n\n Parameter\n Description\n\n --win-store-save\n\n Triggers the ability to store the certificate and private key into the \"MY\" certificate store\n\n --win-machine-store\n\n Triggers the ability to store in the Machine store. If not specified, the User store is used. This parameter requires Horizon Client to be executed with appropriate elevated rights.\n\n --win-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used.\n\n Discovery parameter\n\n You can chain a certificate enrollment operation with the discovery operation by using the --discovery parameter. It will use the APIID and APIKey defined in the general configuration to authenticate to Horizon and feed it with the enrolled certificate and its discovery metadata.\n\n The --discovery parameter takes a value, which is the name of the Discovery campaign to use to report the certificate to Horizon.\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n ACME Certificate Lifecycle Operations", @@ -3505,7 +3812,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -3521,7 +3828,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n This document is specific to Horizon Client version 1.8 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n General Configuration and Usage", @@ -3593,7 +3900,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -3620,7 +3927,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -3644,7 +3951,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.8/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -3671,7 +3978,7 @@ "section": "automation.html", "slug": "automation.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/automation.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/automation.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/automation.html", "breadcrumbs": [ "Horizon Client", "Automatic TLS Certificate Installation" @@ -3699,7 +4006,7 @@ "section": "bulk.html", "slug": "bulk.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/bulk.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/bulk.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/bulk.html", "breadcrumbs": ["Horizon Client", "Bulk Operations"], "summary": "Bulk operations The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL). Bulk update The bulk update command allows update of certificate metadata en masse. The command ta", "content": "Bulk operations\n\n The horizon client allows you to perform bulk operations on certificates using the Horizon Certificate Query Language (HCQL).\n\n Bulk update\n\n The bulk update command allows update of certificate metadata en masse. The command takes a HCQL query as parameter and updates the matching certificates with the provided metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 1. Bulk update command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk update --query 'module equals \"est\" and status is valid' --owner \"myuser\" --team \"myteam\" --labels \"mylabel:myvalue\" --contact-email \"unset\"\n\n Bulk migrate\n\n The bulk migrate command allows certificate migration from one profile to another. The command takes an HCQL query as parameter and migrate the matching certificates to the provided profile. The command can also update the certificates metadata. You can update the owner , the team , the labels and the contact email of the certificates. To unset an existing value use the value \"unset\" .\n\n Table 2. Bulk migrate command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n --profile\n\n The target profile for the migration.\n\n --owner\n\n The owner to set on certificates matching the query. (Optional)\n\n --team\n\n The team to set on certificates matching the query. (Optional)\n\n --labels\n\n The labels, in the comma separated key:value form, to set on certificates matching the query. (Optional)\n\n --contact-email\n\n The contact email to set on certificates matching the query. (Optional)\n\n horizon-cli bulk migrate --query 'module equals \"est\" and status is valid' --profile new-est-profile --team myteam --labels mylabel:myvalue\n\n Bulk revoke\n\n The bulk revoke command allows certificate revocation en masse. The command takes an HCQL query as parameter and revoke the matching certificates.\n\n Table 3. Bulk revoke command parameters\n\n Parameter\n Description\n\n --query\n\n The HCQL query string. Update will be performed on results.\n\n --confirm\n\n Skip confirm.\n\n horizon-cli bulk revoke --query 'team equals \"myterminatedteam\" and status is valid' --confirm\n\n Updating a certificate\n Automatic TLS Certificate Installation", @@ -3715,7 +4022,7 @@ "section": "config.html", "slug": "config.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/config.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/config.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/config.html", "breadcrumbs": ["Horizon Client", "General Configuration and Usage"], "summary": "General Configuration and Usage Installations Package install/uninstall Using RPMs file Installing the package yum install horizon-cli-<version>-1.x86_64.rpm Uninstalling the package yum remove horizon-cli Using MSI file: To install t", "content": "General Configuration and Usage\n\n Installations\n\n Package install/uninstall\n\n Using RPMs file\n\n Installing the package\n\n yum install horizon-cli-<version>-1.x86_64.rpm\n\n Uninstalling the package\n\n yum remove horizon-cli\n\n Using MSI file:\n\n To install the package, double click on the MSI file and follow the instructions.\nTo uninstall the package, simply browse to the Applications & program menu and uninstall the program.\n\n Using binary file:\n\n The linux binary file is usable on any linux distribution, to install it follow the steps below :\n\n Add the binary file to the \"PATH\", in order to easily launch it on your shell.\n\n Apply the executable permission on the binary file\n\n chmod +x horizon-cli.bin\n\n Command line installation & initialization\n\n Use the command below to install the client and generate interactively your configuration file:\n\n horizon-cli install\n\n The configuration file can also be created using command line parameters:\n\n horizon-cli install --endpoint https://horizon-test.com\n\n Use the help to get the full list of available parameters.\n\nIf you did not use an installer, this command should always be run first to ensure everything is set up correctly.\n\n Configuration content\n\n General parameters of Horizon Client are configured through a file placed in one of the following locations:\n\n /opt/horizon/etc/horizon-cli.conf\n\n /usr/local/etc/horizon-cli.conf\n\n [C|D]:\\ProgramData\\EverTrust\\Horizon\\horizon-cli.conf\n\n The configuration file is in JSON format and contains the following:\n\n {\n \"api_id\": \"API-ID\",\n \"api_key\": \"API-Key\",\n \"endpoint\": \"endpoint url. e.g. https://horizon-test.evertrust.fr\",\n \"debug\": false,\n \"timeout\": 2,\n \"proxy\": \"proxy. e.g. http://myproxy.corp.local:3128\",\n \"root_ca\": \"Root CA PEM Certificate(s).\",\n \"log_file\": \"The log file of Horizon.\"\n}\n\n These parameters may be instead specified or overridden using environment variables, as detailed in the table below.\n\n Table 1. General configuration parameters\n\n Parameter\n Environment variable\n Description\n\n api_id\n\n APIID\n\n The API ID: the identifier of a local account user defined in Horizon. Used for discovery, import modes and for the revocation in the EST module\n\n api_key\n\n APIKEY\n\n The API Key. Used together with API ID\n\n endpoint\n\n ENDPOINT\n\n The URL of the Horizon instance, starting with http or https and without trailing \"/\"\n\n debug\n\n DEBUG\n\n Set to true to enable debug mode of the Horizon Client, defaults to false if unspecified.\n\n timeout\n\n Connection timeout in seconds, defaults to 2 seconds if unspecified.\n\n proxy\n\n https_proxy\n\n HTTPS proxy used to reach Horizon (if any), in URL form which can contain login and password if needed.\n\n root_ca\n\n PEM chain of CA certificates that issued the TLS certificate exposed by Horizon. This parameter is optional, as preferred way is to put these CA certificates in the machine trust store.\n\n log_file\n\n LOGFILE\n\n Log file of horizon. This parameter is optional, but a default value is set as the Horizon Client displays useful messages on STDOUT and logs should always be kept.\n\n You can use the “--help” parameter to get command line help on any command or sub-command.\n\n horizon-cli <command> <subcommand> --help\n\n Introduction\n Discovery Operations", @@ -3740,7 +4047,7 @@ "section": "discovery.html", "slug": "discovery.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/discovery.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/discovery.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/discovery.html", "breadcrumbs": ["Horizon Client", "Discovery Operations"], "summary": "Discovery Operations These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of th", "content": "Discovery Operations\n\n These operations aim at feeding Horizon with certificates discovered on the network through different means. These certificates will be fed along with appropriate Discovery metadata, such as IP address or Hostname of the machine on which the discovered certificate is held.\n\n Local Scan\n\n In local scan mode, the Horizon Client will scan the machine it is installed on for certificates, and reports them to Horizon. Certificates are discovered if they match following conditions:\n\n They are saved in PEM or DER format in a file that is pointed in a configuration file\n\n They are contained in a Machine or User \"MY\" certificate store (Windows Only)\n\n They are not CA certificates\n\n In local scan mode, Horizon client should be launched with root or administrator rights, or it will probably fail to discover all certificates.\n\n horizon-cli localscan --campaign=test\n\n Network Scan\n\n In network scan mode, the Horizon Client will first connect to Horizon to get the campaign’s scanning parameters (Hosts and Ports), then perform the network scanning and feed Horizon with the scan results.\n\n The following algorithm is used for network scanning:\n\n If --ping-first flag is given, perform ICMP ping on the defined hosts and discard hosts that are not reachable\n\n Scan the hosts and ports for an open TCP port\n\n If TCP port is opened:\n\n If port is not '25', try a TLS handshake. If handshake succeeds, retrieve the certificate and report it to Horizon\n\n If port is '25', perform SMTP STARTTLS, retrieve the certificate and report it to Horizon\n\n The \"timeout\" global configuration variable has an impact on both open ports discovery and TLS handshake. In case you get unexpected handshake errors or EOF, try to increase the timeout. However, this will also make the network scan perform slower.\n\n horizon-cli netscan --campaign=test\n\n In order to perform network scans on a recurring schedule, the Horizon Client offers the possibility to create periodic tasks to run a scan.\n\n The three supported options for the period parameter are:\n\n daily - runs the task everyday between 0-4 AM UTC\n\n weekly - runs the task every Sunday between 0-4 AM UTC\n\n monthly - runs the task on the first day of the month between 0-4 AM UTC\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly\n\n This periodic task can be run with a specific user identity on Linux using the user parameter.\n\n horizon-cli netscan --campaign=test --create-periodic-task --period=monthly --user=horizon-cli\n\n The created task can then be removed using:\n\n horizon-cli netscan --campaign=test --remove-periodic-task\n\n nmap import\n\n In nmap import mode, the discovery itself is performed by nmap, using the ssl-cert plugin. Horizon Client then has the ability to import the nmap scanning results into Horizon using the nmap import mode.\n\n To be able to do so, nmap needs to be launched with the -oX option, in order to export its scan result as XML file. This XML file is then passed on to Horizon Client.\n\n horizon-cli importscan nmap --campaign=test --xmlfile=nmapresults.xml\n\n Qualys Certificate View import\n\n In Qualys Certificate View (CV) import mode, the discovery itself is performed by Qualys CV. Horizon Client then has the ability to import the Qualys CV scanning results into Horizon using the qualyscv import mode.\n\n To be able to do so, a technical account must have been created into Qualys CV for Horizon Client, with appropriate rights to be able to view the scanning results. You need also to identify your Qualys CV API Gateway URL using the following link .\n\n horizon-cli importscan qualyscv --campaign=test --endpoint=https://gateway.qg1.apps.qualys.eu --username=testlogin --password=testpassword\n\n Nessus Scan Import\n\n In Nessus scan import mode, Horizon Client enables the importation of scanning results from Nessus into Horizon. This mode allows for a seamless integration of Nessus vulnerability scans into the Horizon environment.\n\n To utilize this feature, you need to ensure that you have valid credentials for Nessus with the necessary permissions to access and export scan data and the scan id on which you want to perform the import. Additionally, you must know your Nessus URL through which Horizon Client will communicate with the Nessus API and use the \"SSL Certificate Information\" plugin output to get the certificates into horizon.\n\n horizon-cli importscan nessus --campaign=test --endpoint=https://cloud.tenable.com --username=testlogin --password=testpassword --scan-id=5\n\n General Configuration and Usage\n Import operations", @@ -3756,7 +4063,7 @@ "section": "est.html", "slug": "est.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/est.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/est.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/est.html", "breadcrumbs": ["Horizon Client", "EST Certificate Lifecycle Operations"], "summary": "EST Certificate Lifecycle Operations EST Enrollment Horizon Client is able to use the EST module of Horizon to enroll certificates. Enrollment modes The following enrollment modes are supported: Authorized user/password in decentralized mod", "content": "EST Certificate Lifecycle Operations\n\n EST Enrollment\n\n Horizon Client is able to use the EST module of Horizon to enroll certificates.\n\n Enrollment modes\n\n The following enrollment modes are supported:\n\n Authorized user/password in decentralized mode\n\n Authorized user/password in centralized mode\n\n Challenge password in decentralized mode\n\n Challenge password in centralized mode\n\n Certificate swap in decentralized mode\n\n Certificate swap in centralized mode\n\n Authorized user\n\n In this enrollment mode, a local user account is created in Horizon for Horizon Client, and the EST profile on Horizon is configured in authorized mode thus a static username and password can be provided to Horizon Client for enrollment.They need to be set in general configuration as APIID and APIKEY .\n\n horizon-cli est enroll --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Challenge password\n\n In this enrollment mode, the EST profile on Horizon is set to challenge mode. A request must then be made on Horizon in order to retrieve the one-time password challenge to be used to authenticate the EST request.No APIID nor APIKEY need to be set.\n\n Use the --challenge option.\n\n horizon-cli est enroll --challenge=<challenge> --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Certificate swap\n\n In this enrollment mode, the EST profile on Horizon is set to x509 mode.The client is then able to make a request to Horizon by authenticating with an existing certificate.This certificate can be specified either:\n\n by using the --key and --cert parameters, respectively pointing at the key and the certificate to be used to authenticate\n\n by using the --win-store-auth parameter (Windows only), that will look into the \"MY\" certificate store (user by default, unless --win-machine-store is specified) for a non-expired certificate whose CN matches the Common Name specified in --cn parameter\n\n Use the --in-cert , --win-user-store-auth or --win-computer-store-auth option.\n\n horizon-cli est enroll --in-cert=/path/to/cert/to/swap --in-key=/path/to/key/to/swap --profile=test --key=/path/to/key --cert=/path/to/cert --cn=TestCN [data parameters] [key and certificate parameters]\n\nhorizon-cli est enroll --win-user-store-auth --profile=test --cn=TestCN [data parameters] [key and certificate parameters]\n\n Decentralized mode\n\n In decentralized mode, which is the default mode, Horizon Client generates a private key and a CSR.The CSR is generated according to the given certificate parameters, and the private key and the retrieved certificate are then stored according to the output parameters.\n\n Centralized mode\n\n In Centralized mode, triggered by adding the “--centralized” parameter to the command line, Horizon Client generates a fake private key and a CSR.The CSR is generated according to certificate parameters.The private key generated by Horizon Client is discarded.A random password is generated and inserted into the CSR.If the enrollment is successful, Horizon generates a private key and a certificate and sends them back to Horizon Client as PKCS#12, which Horizon Client decodes using the randomly generated password.The retrieved private key and the retrieved certificate are then stored according to the output parameters.\n\n The random password generated has 16 characters, letters and numbers.If a password policy is enforced on Horizon side for the centralized mode in the considered EST profile, ensure that it is compatible with such characteristics.\n\n General enrollment parameters\n\n Table 1. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --challenge\n\n Challenge generated on Horizon on the profile. Mandatory in challenge mode\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after enrollment\n\n --centralized\n\n Switches to centralized enrollment\n\n --script\n\n Path to the script to execute after enrollment. See script for more details\n\n Input certificate parameters (x509 mode)\n\n These parameters define how to find the certificate to swap in x509 mode . It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 2. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Certificate parameters\n\n Table 3. Data parameters\n\n Parameter\n\n Description\n\n --cn\n\n Requested subject Common Name. Single value\n\n --ou\n\n Requested subject OU . Can contain multiple values\n\n --dnsnames\n\n Requested subject alternative name DNS entries. Can contain multiple values\n\n --ip\n\n Requested subject alternative name IP entries. Can contain multiple values\n\n --emails\n\n Requested subject alternative name RFC822Name entries. Can contain multiple values\n\n Table 4. Metadata parameters\n\n Parameter\n\n Description\n\n --contact-email\n\n Contact email of the request. Single value\n\n --owner\n\n Owner of the request. Single value\n\n --team\n\n Team of the request. Single value\n\n --labels\n\n Labels of the request. Can contain multiple values\n\n Table 5. Crypto parameters\n\n Parameter\n\n Description\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 6. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 7. Windows parameters\n\n Parameter\n\n Description\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n EST Renewal\n\n The certificate renewal is performed by using the “renew” command.\n\n it is designed to renew a certificate already issued by Horizon on the same profile.\n\n it can be scheduled as a periodic task (cron or Scheduled Task), that will perform the renewal only when the certificate is N days before its expiration. N can be specified using the “--renewal-interval” parameter, and defaults to 30.\n\n horizon-cli est renew --profile=test --in-cert=/path/to/cert/to/renew [key and certificate parameters]\n\nhorizon-cli est renew --profile=test --win-store-auth --cn=TestCN [key and certificate parameters]\n\n General renewal parameters\n\n Table 8. General parameters\n\n Parameter\n\n Description\n\n --profile\n\n Horizon’s technical name of the profile to enroll on. Mandatory\n\n --discovery\n\n Horizon’s discovery campaign name to use in order to report the certificate to Horizon after renewal\n\n --centralized\n\n Switches to centralized enrollment\n\n --key-type\n\n Key-type of the certificate. See key types for more details\n\n --script\n\n Path to the script to execute after renewal. See script for more details\n\n --renewal-interval\n\n Number of days before expiration to trigger the renewal. Defaults to 30\n\n Input certificate parameters\n\n These parameters define how to find the certificate to renew. It can be stored in the following formats:\n\n Key and certificate stored separately in two files, in PEM format ( --in-cert & --in-key )\n\n Key and certificate stored together in a PKCS#12 file ( --in-cert & --in-pfx-pwd )\n\n Key and certificate stored together in a JKS file ( --in-cert & --in-jks-pwd & --in-jks-alias & --in-jks-alias-pwd )\n\n Key and certificate stored together in Windows certificate store:\n\n Using certificate thumbprint, available in the details tab of windows certificate explorer or in certutil ( --in-cert )\n\n Using the certificate CN (see Windows parameters )\n\n Table 9. Input certificate parameters\n\n Parameter\n\n Description\n\n --in-cert\n\n Path to the certificate to renew (PEM file, PKCS#12 file, JKS file) or certificate thumbprint for Windows certificate store entries\n\n --in-key\n\n Path to the private key of the certificate to renew if --in-cert is a PEM file\n\n --in-pfx-pwd\n\n Password for the PKCS#12 file to renew\n\n --in-jks-pwd\n\n Password for the JKS file to renew\n\n --in-jks-alias\n\n Alias for the JKS file to renew\n\n --in-jks-alias-pwd\n\n Alias password for the JKS file to renew\n\n Output parameters\n\n These parameters define how to store the retrieved certificate and its associated private key. The following alternatives are available:\n\n Key and certificate stored separately in two files, in PEM format. This is typically used by Apache or NGINX web servers;\n\n Key and certificate stored together in a PKCS#12 file. This is typically used by Tomcat application server;\n\n Key and certificate stored together in Windows certificate store. This is typically used by IIS web server (see Windows parameters )\n\n Table 10. Output parameters\n\n Parameter\n\n Description\n\n --cert\n\n Path to the certificate to store\n\n --key\n\n Path to the private key to store\n\n --ca-chain\n\n Path to the chain to store\n\n --pfx\n\n Path to write the PKCS#12 output\n\n --pfx-pwd\n\n Password for the PKCS#12 output. Mandatory if --pfx is set\n\n --pfx-aes\n\n Enable AES encryption for PKCS#12, compatible with openssl v3\n\n --jks\n\n Path to write the JKS output\n\n --jks-pwd\n\n Password for the JKS output. Mandatory if --jks is set\n\n --jks-alias\n\n Alias for the JKS output. Mandatory if --jks is set\n\n --jks-alias-pwd\n\n Password for the alias in the JKS output. Mandatory if --jks is set\n\n --overwrite\n\n Always overwrite existing files\n\n Windows parameters\n\n These parameters define how to integrate with the Windows certificate store:\n\n Table 11. Windows parameters\n\n Parameter\n\n Description\n\n --cn\n\n CN of the certificate to renew in the Windows certificate store. Use with --win-store-auth\n\n --win-user-store-auth\n\n Triggers the use of Windows current user certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-computer-store-auth\n\n Triggers the use of Windows local machine certificate store for certificate authentication. Most recent valid certificate with matching CN will be used\n\n --win-user-store-save\n\n Triggers the use of user Windows certificate store to save the certificate after enrollment\n\n --win-computer-store-save\n\n Triggers the use of computer Windows certificate store to save the certificate after enrollment\n\n --win-store-use-tpm\n\n Triggers the ability to store the certificate in the Microsoft Platform Crypto Provider KSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-use-legacy\n\n Triggers the ability to store the certificate in the legacy Microsoft Enhanced Cryptographic Provider v1.0 CSP. If not specified, the Microsoft Software Key Storage Provider KSP will be used\n\n --win-store-set-exportable\n\n Marks the key as exportable from the Windows certificate store. If not specified, the key is not exportable\n\n Key Types\n\n Depending on your Horizon version, the following key types are supported:\n\n RSA\n\n To add a RSA key type, the following syntax must be used.\n\n rsa-<key-size>\n\n rsa-2048 , rsa-3072 , rsa-4096\n\n ECDSA\n\n To add a ECDSA key type, the following syntax must be used.\n\n ec-<curve>\n\n The following curves are supported:\n\n secp256r1\n\n secp384r1\n\n secp521r1\n\n ec-secp256r1 , ec-secp384r1\n\n EDDSA\n\n To add a EDDSA key type, the following syntax must be used.\n\n ed-<curve>\n\n The following curves are supported:\n\n Ed25519\n\n ed-Ed25519\n\n Script parameter\n\n You can tell Horizon Client to launch a script upon successful certificate enrollment or renewal by using the --script parameter, which takes the path to the script as an argument.\n\n The script will receive arguments passed by Horizon Client in the following order:\n\n Issued certificate serial number\n\n Issued certificate fingerprint (SHA-1 hash of the certificate in DER format - windows store thumbprint)\n\n Issued certificate Subject DN\n\n Issued certificate Issuer DN\n\n Below is an example of a very simple bash script:\n\n #!/bin/sh\n\necho $1\necho $2\necho $3\necho $4\n\n Below is an example of a very simple PowerShell script:\n\n param($serial, $fingerprint, $subject, $issuer)\n\nWrite-Output $serial\nWrite-Output $fingerprint\nWrite-Output $subject\nWrite-Output $issuer\n\n Examples\n\n You will find below a few examples detailing how to use the client for EST enrollment in various context\n\n Decentralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --key=/path/to/key --cert=/path/to/cert --cn=test.example.com --dnsnames=test.example.com,www.test.example.com\n\n Decentralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Centralized enrollment with challenge, output as key and certificate\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --cert=/path/to/cert --key=/path/to/key\n\n Centralized enrollment with challenge, output as PKCS#12\n\n horizon-cli est enroll --centralized --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --pfx=/path/to/pkcs12 --pfx-pwd=<pkcs12_password>\n\n Decentralized enrollment with challenge, output in machine windows store\n\n horizon-cli est enroll --challenge=<challenge> --profile=<profile> --cn=test.example.com --dnsnames=test.example.com,www.test.example.com --win-store-save --win-machine-store\n\n Decentralized renewal from certificate and key, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/cert --in-key=/path/to/old/key --cert=/path/to/new/cert --key=/path/to/new/key\n\n Decentralized renewal from PKCS#12, output as key and certificate\n\n horizon-cli est renew --profile=<profile> --in-cert=/path/to/old/pkcs12 --cert=/path/to/cert --key=/path/to/key\n\n Decentralized renewal using machine windows store\n\n horizon-cli est renew --profile=<profile> --cn=test.example.com --win-store-auth --win-store-save --win-machine-store\n\n Import operations\n SCEP Certificate Lifecycle Operations", @@ -3780,7 +4087,7 @@ "section": "import.html", "slug": "import.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/import.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/import.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/import.html", "breadcrumbs": ["Horizon Client", "Import operations"], "summary": "Import Operations Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database. Local Import In order to", "content": "Import Operations\n\n Import operations are designed to import certificate into Horizon without any metadata. This is useful mainly when installing Horizon, e.g. to import all certificates from an existing PKI database.\n\n Local Import\n\n In order to be able to import certificates, you need to put them as PEM files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS\n\n By default, this command does not import CA certificates. To import CA certificates, use the --enable-ca-import flag.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --enable-ca-import\n\n If you wish to import certificates along with their private keys (e.g. when importing from a PKI escrow), you need to put them as PKCS#12 files in a folder, and launch Horizon Client by pointing at that folder. Horizon Client will recurse on the folder, find all PEM files, and import certificates into Horizon. It is advised to use sub-folders to store certificates, so that you avoid to hit any file-per-folder file system limit. All the PKCS#12 files must be encrypted using the same password that will be passed to Horizon Client using the command line.\n\n horizon-cli localimport --campaign=test --path=/path/to/certs --source=MyADCS --pfx-password=<pkcs12_password>\n\n You can also import certificates from a csv file. Certificates must be in a column named \"certificate\". As of now, three formats are supported:\n\n DERBase64: Certificate in DER (binary) Base 64 encoded (default);\n\n DERHex: Certificate in DER (binary) Hex String encoded;\n\n PEM: Certificate in PEM (with or without the certificate header and footer).\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\"\n\n In order to add technical metadata to the imported certificate, the --csv-metadata flag can be used to import metadata from a column with the same name. For example, to configure a pki_connector on each certificate with a file containing the pki_connector column:\n\n horizon-cli localimport --campaign=test --csv /path/to/csv/file.csv --csv-separator \";\" --csv-metadata pki_connector\n\n Supported metadata are:\n\n pki_connector\n\n certeurope_id\n\n digicert_id\n\n digicert_order_id\n\n entrust_id\n\n fcms_id\n\n gsatlas_id\n\n metapki_id\n\n Network Import\n\n DigiCert CertCentral\n\n You can import all your valid certificates from DigiCert CertCentral. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport digicert --campaign=test --digicert-api-key=<api-key>\n\n AWS ACM\n\n You can import all your valid certificates from AWS ACM. Please note that only certificates in \"issued\" state can be imported. Certificates that are revoked will not be imported.\n\n horizon-cli netimport aws-acm --campaign=test --aws-region=<aws-region> --access-key-id=<aws-access-key-id> --secret-access-key=<aws-secret-access-key>\n\n AWS Role Assumption is supported. You need to provide the ARN of the role you wish to assume using the --assume-role-arn option.\n\n Azure Key Vault\n\n You can import all your valid certificates from Azure Key Vault. Please note that only certificates in \"issued\" state can be imported. Certificates that are in pending state will not be imported.\n\n horizon-cli netimport akv --campaign=test --vault-name=<vault short name> --azure-tenant=<tenant name> --client-id=<client app Id> --client-secret=<client app secret>\n\n F5 BIG-IP\n\n You can import all your valid certificates from F5 BIG-IP.\n\n horizon-cli netimport bigip --campaign=test --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\n It is also possible to import the certificates as managed certificates in Horizon. This will allow renewal and removal of the certificate upon revocation using Horizon’s triggers mechanism.\n\n In order to activate this behavior, the connector property must reference a valid F5 Connector in Horizon.\n\n horizon-cli netimport bigip --campaign=test --connector=<Horizon F5 Connector name> --hostname=<F5 BigIp hostname> --login=<F5 BigIp login> --password=<F5 BigIp password>\n\nIn order for the trigger mechanism to work correctly, an Horizon WebRA profile must use the F5 Connector trigger and a schedule task should reference the connector and the WebRA profile.\n\n Discovery Operations\n EST Certificate Lifecycle Operations", @@ -3796,7 +4103,7 @@ "section": "introduction.html", "slug": "introduction.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/introduction.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/introduction.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/introduction.html", "breadcrumbs": ["Horizon Client", "Introduction"], "summary": "Introduction Description Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms: Linux for x86-64 and arm64 processors Windows for x86-64 processor", "content": "Introduction\n\n Description\n\n Horizon Client is the client software associated to EverTrust Horizon. This client is developed in Golang, and compiled for the following platforms:\n\n Linux for x86-64 and arm64 processors\n\n Windows for x86-64 processors\n\n Darwin for x86-64 and arm64 processors\n\n AIX for ppc64 processors\n\n System requirements\n\n To run Horizon Client the underlying system must comply with the following minimum requirements :\n\n For certificate lifecycle purposes\n\n 1 gigahertz (GHz) or faster with 1 or more cores\n\n 1 gigabyte (GB) of RAM for Linux environments\n\n 2 gigabyte (GB) of RAM for Microsoft environments\n\n 10 gigabyte (GB) or larger storage device\n\n For discovery purposes\n\n 2 gigahertz (GHz) or faster with 2 or more cores\n\n 2 gigabyte (GB) of RAM for Linux environments\n\n 4 gigabyte (GB) of RAM for Microsoft environments\n\n 20 gigabyte (GB) or larger storage device\n\n This document is specific to Horizon Client version 1.9 , which may be used with EverTrust Horizon 2.4.0 or later.\n\n Scope\n\n This document is a guide describing how to use the Horizon Client to perform the following tasks:\n\n Certificate discovery & import\n\n Certificate lifecycle management\n\n General Configuration and Usage", @@ -3980,7 +4287,7 @@ "section": "scep.html", "slug": "scep.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/scep.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/scep.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/scep.html", "breadcrumbs": [ "Horizon Client", "SCEP Certificate Lifecycle Operations" @@ -4007,7 +4314,7 @@ "section": "update.html", "slug": "update.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/update.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/update.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/update.html", "breadcrumbs": ["Horizon Client", "Updating a certificate"], "summary": "Update operations The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon. This command can either be used to update a certi", "content": "Update operations\n\n The horizon client can perform update operations on certificates using the update-cert command. This will modify the information associated with the certificate on Horizon.\n\n This command can either be used to update a certificate present on your machine or to update certificates on Horizon using an account with sufficient permission.\n\nTo update a local certificate, the 'Update (pop)' common configuration permission must be enabled on the profile the certificate is linked to.\n\n General Parameters\n\n --confirm\n\n The command asks for confirmation after the changes are computed. Use this flag to disable this behavior and proceed directly. (Optional)\n\n --prompt\n\n Use this flag to be prompted for edition of all the certificate fields. In this mode, using enter on an existing value means the value is not changed. (Optional)\n\n Update Parameters\n\n An update concerns only metadata fields, that is fields added by Horizon.\n\n --owner\n\n Set the owner of the certificate. An empty string means deletion of this information. (Optional)\n\n --team\n\n Set the team of the certificate. An empty string means deletion of this information. (Optional)\n\n --contact-email\n\n Set the contact email of the certificate. An empty string means deletion of this information. (Optional)\n\n --labels\n\n Set the labels of the certificate. An empty string means deletion of this information. (Optional)\n\n --metadata\n\n Set the technical metadata of the certificate. To use with caution. An empty string means deletion of this information. (Optional)\n\n Certificate selection parameters\n\n Local certificate\n\n The update is only possible on local certificates for which you possess the key:\n\n --cert\n\n Path to the certificate to update (PEM file, PKCS#12 file, JKS file) or cert thumbprint for\nWindows certificate store entries. (Optional)\n\n --key\n\n Path to the private key of the certificate to update if it is not included in the certificate\nfile. (Optional)\n\n --pfx-pwd\n\n Password for the PKCS#12 file to update. (Optional)\n\n --jks-pwd\n\n Password for the JKS file to update. (Optional)\n\n --jks-alias\n\n Alias for the JKS file to update. (Optional)\n\n --jks-alias-pwd\n\n Alias password for the JKS file to update. (Optional)\n\n Certificate on Horizon server\n\n An account must be configured on the client using horizon-cli install and it must have update permissions on the certificate\n\n --id\n\n Id of the certificate to update (Optional)\n\n Examples\n\n You will find below a few examples detailing how to use the client to update certificates in various contexts\n\n Updating the owner of a certificate\n\n horizon-cli update-cert --cert=/path/to/cert --key=/path/to/key --owner=newowner\n\n Removing the team from a certificate stored in JKS file\n\n horizon-cli update-cert --cert=/path/to/cert.jks --jks-pwd=<jks_password> --team=\"\"\n\n Updating labels and metadata of a certificate stored in windows certificate store\n\n horizon-cli update-cert --cert=<certificate_thumbprint> --labels=\"label1:value1,label2:value2\" --metadata=\"metadata1:value1,metadata2:value2\"\n\n Updating contact email of a certificate referenced on Horizon\n\n horizon-cli update-cert --id=<certificate_id> --contact-email=\" [email protected] \"\n\n WebRA Certificate Lifecycle Operations\n Bulk Operations", @@ -4031,7 +4338,7 @@ "section": "webra.html", "slug": "webra.html", "url": "https://docs.evertrust.fr/horizon-cli/1.9/webra.html", - "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.15/webra.html", + "canonical_url": "https://docs.evertrust.fr/horizon-cli/1.16/webra.html", "breadcrumbs": [ "Horizon Client", "WebRA Certificate Lifecycle Operations" @@ -4129,11 +4436,11 @@ "keywords": ["usage", "html", "horizon", "issuer"] }, { - "page_id": "terraform-provider-horizon:0.4.0:certificate", + "page_id": "terraform-provider-horizon:0.5.0:certificate", "product": "terraform-provider-horizon", "kind": "companion", "source": "terraform-registry", - "version": "0.4.0", + "version": "0.5.0", "title": "horizon_certificate Resource", "section": "resources", "slug": "certificate", @@ -4154,11 +4461,11 @@ ] }, { - "page_id": "terraform-provider-horizon:0.4.0:index", + "page_id": "terraform-provider-horizon:0.5.0:index", "product": "terraform-provider-horizon", "kind": "companion", "source": "terraform-registry", - "version": "0.4.0", + "version": "0.5.0", "title": "horizon Provider", "section": "overview", "slug": "index", diff --git a/src/generated/docs/doc-versions.json b/src/generated/docs/doc-versions.json index b262144..55a0ba8 100644 --- a/src/generated/docs/doc-versions.json +++ b/src/generated/docs/doc-versions.json @@ -1,5 +1,5 @@ { - "generatedAt": "2026-04-14T15:50:49.357Z", + "generatedAt": "2026-04-28T14:22:07.017Z", "products": { "horizon": { "product": "horizon", @@ -31,7 +31,7 @@ }, "horizon-cli": { "product": "horizon-cli", - "latest": "1.15", + "latest": "1.16", "versions": [ "1.5", "1.6", @@ -43,7 +43,8 @@ "1.12", "1.13", "1.14", - "1.15" + "1.15", + "1.16" ], "defaultPolicy": "latest-indexed", "provenance": "Official Evertrust documentation sitemap" @@ -57,8 +58,8 @@ }, "terraform-provider-horizon": { "product": "terraform-provider-horizon", - "latest": "0.4.0", - "versions": ["0.4.0"], + "latest": "0.5.0", + "versions": ["0.5.0"], "defaultPolicy": "latest-indexed", "provenance": "Terraform Registry provider metadata" }, diff --git a/src/generated/docs/product-doc-pages.json b/src/generated/docs/product-doc-pages.json index 2d984b6..8d88961 100644 --- a/src/generated/docs/product-doc-pages.json +++ b/src/generated/docs/product-doc-pages.json @@ -1,6 +1,6 @@ { - "generatedAt": "2026-04-14T15:50:18.413Z", - "pageCount": 1128, + "generatedAt": "2026-04-28T14:21:29.349Z", + "pageCount": 1130, "pages": [ { "page_id": "horizon:2.2:admin-guide:ca", @@ -12820,7 +12820,7 @@ "Advanced usage" ], "summary": "Advanced usage Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a Docker registry proxy If your installation environment requi", - "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a Docker registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images.\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use a CRD (Custom Resource Definition) named Lease ( akka.io/v1/leases ).\nWe strongly recommend that you use this mechanism, however it implies that you have the necessary permissions to install CRDs onto your server.\nIn case you don’t, the feature can be disabled by passing the --skip-crds flag to the Helm command when installing the chart, and setting the leases.enabled key to false .\nIf you want to manually install the CRD, you can check the crds/leases.yml file.\n\n Injecting extra configuration\n\n Extra Horizon configuration can be injected to the bundled application.conf file to modify low-level behavior of Horizon.\nThis should be used carefully as it may cause things to break.\nTo do so, use the extraConfig value in your values.yaml file:\n\n This can be done with the following edits to your values.yaml file:\n\n extraConfig: |\n play.server.http.port = 9999\n horizon {\n notification.mail.attachment.extension.der = \"der\"\n }\n\n Extra configurations are included at the end of the config file, overriding any previously set config value.\n\nAn exhaustive list of configuration options can be found on the Overridable configuration parameters page.\n\n Custom startup scripts\n\nFeature available starting from version 2.5.5\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\nUsing the Helm chart, this can be achieved easily using the following values.yaml overrides:\n\n extraVolumes:\n - name: horizon-entrypoint-scripts\n configMap:\n name: horizon-entrypoint-scripts\n\nextraVolumeMounts:\n - name: horizon-entrypoint-scripts\n mountPath: /docker-entrypoint.d/\n\n Given you’ve previously create a ConfigMap called horizon-entrypoint-scripts :\n\n apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: horizon-entrypoint-scripts\ndata:\n run-on-startup.sh: |\n echo \"Hello World !\"\n\nBy design, Horizon is configured to run as an unprivileged user inside the container to follow industry best practices.\nThis means that your scripts won’t be able to perform privileged operations on the container, such as trusting custom CAs.\nIf you do want to overcome this problem, you can run the container as root , even though it is generally discouraged.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Akka , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Akka Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Akka Management, a tool for helping nodes coordinate.\nFor documentation, see Akka Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Akka Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Akka Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Figure 1. Sequence diagram of the cluster management of Horizon\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Akka Management\n\n Green\n\n HTTP\n\n 8558 (by default)\n\n Akka Remote\n\n Red\n\n TCP (by default)\n\n 25520\n\n Uninstallation\n Installing on Openshift", + "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a Docker registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images.\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use a CRD (Custom Resource Definition) named Lease ( akka.io/v1/leases ).\nWe strongly recommend that you use this mechanism, however it implies that you have the necessary permissions to install CRDs onto your server.\nIn case you don’t, the feature can be disabled by passing the --skip-crds flag to the Helm command when installing the chart, and setting the leases.enabled key to false .\nIf you want to manually install the CRD, you can check the crds/leases.yml file.\n\n Injecting extra configuration\n\n Extra Horizon configuration can be injected to the bundled application.conf file to modify low-level behavior of Horizon.\nThis should be used carefully as it may cause things to break.\nTo do so, use the extraConfig value in your values.yaml file:\n\n This can be done with the following edits to your values.yaml file:\n\n extraConfig: |\n play.server.http.port = 9999\n horizon {\n notification.mail.attachment.extension.der = \"der\"\n }\n\n Extra configurations are included at the end of the config file, overriding any previously set config value.\n\nAn exhaustive list of configuration options can be found on the Overridable configuration parameters page.\n\n Custom startup scripts\n\nFeature available starting from version 2.5.5\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\nUsing the Helm chart, this can be achieved easily using the following values.yaml overrides:\n\n extraVolumes:\n - name: horizon-entrypoint-scripts\n configMap:\n name: horizon-entrypoint-scripts\n\nextraVolumeMounts:\n - name: horizon-entrypoint-scripts\n mountPath: /docker-entrypoint.d/\n\n Given you’ve previously create a ConfigMap called horizon-entrypoint-scripts :\n\n apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: horizon-entrypoint-scripts\ndata:\n run-on-startup.sh: |\n echo \"Hello World !\"\n\nBy design, Horizon is configured to run as an unprivileged user inside the container to follow industry best practices.\nThis means that your scripts won’t be able to perform privileged operations on the container, such as trusting custom CAs.\nIf you do want to overcome this problem, you can run the container as root , even though it is generally discouraged.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Akka , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Akka Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Akka Management, a tool for helping nodes coordinate.\nFor documentation, see Akka Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Akka Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Akka Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Sequence diagram of the cluster management of Horizon\n\n sequenceDiagram\n autonumber\n rect rgb(191, 223, 255)\n Pod1 ->> Kubernetes API: Discovery request\n destroy Kubernetes API\n Kubernetes API ->> Pod1: Returns other pods addresses\n end\n Note right of Pod2: 1-2: Discovery process\n\n rect rgb(156, 250, 152)\n Pod1 ->> Pod2: Contact Akka Management\n Pod2 ->> Pod1: Returns already contacted nodes\n\n break when an existing cluster is found\n Pod1 ->> Pod2: Joins the existing cluster\n end\n\n break when no existing cluster is found\n Pod1 ->> Pod1: Self-joins and create cluster\n Pod2 ->> Pod1: Joins the created cluster\n end\n end\n\n Note over Pod1,Pod2: Leader election is performed at this point\n\n Note right of Pod2: 3-7: Bootstrap process\n\n rect rgb(250, 148, 142)\n Pod1 ->> Pod2: Exchanges actor messages\n Pod2 ->> Pod1: Exchanges actor messages\n end\n\n Note right of Pod2: 8-9: Remoting\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Akka Management\n\n Green\n\n HTTP\n\n 8558 (by default)\n\n Akka Remote\n\n Red\n\n TCP (by default)\n\n 25520\n\n Uninstallation\n Installing on Openshift", "keywords": [ "advanced", "usage", @@ -17515,7 +17515,7 @@ "Advanced usage" ], "summary": "Advanced usage Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a Docker registry proxy If your installation environment requi", - "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a Docker registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images.\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use a CRD (Custom Resource Definition) named Lease ( akka.io/v1/leases ).\nWe strongly recommend that you use this mechanism, however it implies that you have the necessary permissions to install CRDs onto your server.\nIn case you don’t, the feature can be disabled by passing the --skip-crds flag to the Helm command when installing the chart, and setting the leases.enabled key to false .\nIf you want to manually install the CRD, you can check the crds/leases.yml file.\n\n Injecting extra configuration\n\n Extra Horizon configuration can be injected to the bundled application.conf file to modify low-level behavior of Horizon.\nThis should be used carefully as it may cause things to break.\nTo do so, use the extraConfig value in your values.yaml file:\n\n This can be done with the following edits to your values.yaml file:\n\n extraConfig: |\n play.server.http.port = 9999\n horizon {\n notification.mail.attachment.extension.der = \"der\"\n }\n\n Extra configurations are included at the end of the config file, overriding any previously set config value.\n\nAn exhaustive list of configuration options can be found on the Overridable configuration parameters page.\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\nUsing the Helm chart, this can be achieved easily using the following values.yaml overrides:\n\n extraVolumes:\n - name: horizon-entrypoint-scripts\n configMap:\n name: horizon-entrypoint-scripts\n\nextraVolumeMounts:\n - name: horizon-entrypoint-scripts\n mountPath: /docker-entrypoint.d/\n\n Given you’ve previously create a ConfigMap called horizon-entrypoint-scripts :\n\n apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: horizon-entrypoint-scripts\ndata:\n run-on-startup.sh: |\n echo \"Hello World !\"\n\nBy design, Horizon is configured to run as an unprivileged user inside the container to follow industry best practices.\nThis means that your scripts won’t be able to perform privileged operations on the container, such as trusting custom CAs.\nIf you do want to overcome this problem, you can run the container as root , even though it is generally discouraged.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Figure 1. Sequence diagram of the cluster management of Horizon\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Uninstallation\n Installing on Openshift", + "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a Docker registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images.\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use a CRD (Custom Resource Definition) named Lease ( akka.io/v1/leases ).\nWe strongly recommend that you use this mechanism, however it implies that you have the necessary permissions to install CRDs onto your server.\nIn case you don’t, the feature can be disabled by passing the --skip-crds flag to the Helm command when installing the chart, and setting the leases.enabled key to false .\nIf you want to manually install the CRD, you can check the crds/leases.yml file.\n\n Injecting extra configuration\n\n Extra Horizon configuration can be injected to the bundled application.conf file to modify low-level behavior of Horizon.\nThis should be used carefully as it may cause things to break.\nTo do so, use the extraConfig value in your values.yaml file:\n\n This can be done with the following edits to your values.yaml file:\n\n extraConfig: |\n play.server.http.port = 9999\n horizon {\n notification.mail.attachment.extension.der = \"der\"\n }\n\n Extra configurations are included at the end of the config file, overriding any previously set config value.\n\nAn exhaustive list of configuration options can be found on the Overridable configuration parameters page.\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\nUsing the Helm chart, this can be achieved easily using the following values.yaml overrides:\n\n extraVolumes:\n - name: horizon-entrypoint-scripts\n configMap:\n name: horizon-entrypoint-scripts\n\nextraVolumeMounts:\n - name: horizon-entrypoint-scripts\n mountPath: /docker-entrypoint.d/\n\n Given you’ve previously create a ConfigMap called horizon-entrypoint-scripts :\n\n apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: horizon-entrypoint-scripts\ndata:\n run-on-startup.sh: |\n echo \"Hello World !\"\n\nBy design, Horizon is configured to run as an unprivileged user inside the container to follow industry best practices.\nThis means that your scripts won’t be able to perform privileged operations on the container, such as trusting custom CAs.\nIf you do want to overcome this problem, you can run the container as root , even though it is generally discouraged.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Sequence diagram of the cluster management of Horizon\n\n sequenceDiagram\n autonumber\n rect rgb(191, 223, 255)\n Pod1 ->> Kubernetes API: Discovery request\n destroy Kubernetes API\n Kubernetes API ->> Pod1: Returns other pods addresses\n end\n Note right of Pod2: 1-2: Discovery process\n\n rect rgb(156, 250, 152)\n Pod1 ->> Pod2: Contact Pekko Management\n Pod2 ->> Pod1: Returns already contacted nodes\n\n break when an existing cluster is found\n Pod1 ->> Pod2: Joins the existing cluster\n end\n\n break when no existing cluster is found\n Pod1 ->> Pod1: Self-joins and create cluster\n Pod2 ->> Pod1: Joins the created cluster\n end\n end\n\n Note over Pod1,Pod2: Leader election is performed at this point\n\n Note right of Pod2: 3-7: Bootstrap process\n\n rect rgb(250, 148, 142)\n Pod1 ->> Pod2: Exchanges actor messages\n Pod2 ->> Pod1: Exchanges actor messages\n end\n\n Note right of Pod2: 8-9: Remoting\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Uninstallation\n Installing on Openshift", "keywords": [ "advanced", "usage", @@ -22313,7 +22313,7 @@ "Advanced usage" ], "summary": "Advanced usage Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a container registry proxy If your installation environment re", - "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a container registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images. It is then possible to override the images being pulled by setting the global.imageRegistry key in your values.yaml file to point to your private registry:\n\n global:\n imageRegistry: <YOUR-PRIVATE-REGISTRY>\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use Kubernetes leases . We strongly recommend that you use this safety mechanism. However, the feature can be disabled by setting the leases.enabled key to false .\n\n Trusting custom CAs\n\nAvailable from image 2.7.5-1\n\n When your application needs to establish secure connections with services that use certificates signed by custom Certificate Authorities, you need to import these CA certificates into your system’s trust store. This documentation shows how to accomplish this using Kubernetes ConfigMaps or Secrets.\n\n 1. Import Your Custom CA Certificate\n\n Choose one of the following methods to store your CA certificate:\n\n A. Using a ConfigMap\n\n extraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n B. Using a Secret\n\n extraObjects:\n - apiVersion: v1\n kind: Secret\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: <YOUR_CA_CERTIFICATE_BASE64_ENCODED>\n\nTo encode your certificate in base64, use: cat your-ca.pem | base64 -w 0\n\n 2. Configure Your Application to Trust the CA Certificate\n\n After creating the ConfigMap or Secret with your CA certificate, configure your application to use it by setting the appropriate environment variable:\n\n A. Loading from ConfigMap\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n B. Loading from Secret\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n secretKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n Notes\n\n The SYSTEM_CA_TRUST environment variable is used by the application to add the provided certificate to the system’s trusted certificate store.\n\n You can provide multiple CA certificates by concatenating multiple certificates under a single key (ensure each certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----)\n\n Example Complete Deployment using Horizon Helm Chart\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\nextraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Figure 1. Sequence diagram of the cluster management of Horizon\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Startup & login\n Installing on Openshift", + "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a container registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images. It is then possible to override the images being pulled by setting the global.imageRegistry key in your values.yaml file to point to your private registry:\n\n global:\n imageRegistry: <YOUR-PRIVATE-REGISTRY>\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use Kubernetes leases . We strongly recommend that you use this safety mechanism. However, the feature can be disabled by setting the leases.enabled key to false .\n\n Trusting custom CAs\n\nAvailable from image 2.7.5-1\n\n When your application needs to establish secure connections with services that use certificates signed by custom Certificate Authorities, you need to import these CA certificates into your system’s trust store. This documentation shows how to accomplish this using Kubernetes ConfigMaps or Secrets.\n\n 1. Import Your Custom CA Certificate\n\n Choose one of the following methods to store your CA certificate:\n\n A. Using a ConfigMap\n\n extraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n B. Using a Secret\n\n extraObjects:\n - apiVersion: v1\n kind: Secret\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: <YOUR_CA_CERTIFICATE_BASE64_ENCODED>\n\nTo encode your certificate in base64, use: cat your-ca.pem | base64 -w 0\n\n 2. Configure Your Application to Trust the CA Certificate\n\n After creating the ConfigMap or Secret with your CA certificate, configure your application to use it by setting the appropriate environment variable:\n\n A. Loading from ConfigMap\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n B. Loading from Secret\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n secretKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n Notes\n\n The SYSTEM_CA_TRUST environment variable is used by the application to add the provided certificate to the system’s trusted certificate store.\n\n You can provide multiple CA certificates by concatenating multiple certificates under a single key (ensure each certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----)\n\n Example Complete Deployment using Horizon Helm Chart\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\nextraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Sequence diagram of the cluster management of Horizon\n\n sequenceDiagram\n autonumber\n rect rgb(191, 223, 255)\n Pod1 ->> Kubernetes API: Discovery request\n destroy Kubernetes API\n Kubernetes API ->> Pod1: Returns other pods addresses\n end\n Note right of Pod2: 1-2: Discovery process\n\n rect rgb(156, 250, 152)\n Pod1 ->> Pod2: Contact Pekko Management\n Pod2 ->> Pod1: Returns already contacted nodes\n\n break when an existing cluster is found\n Pod1 ->> Pod2: Joins the existing cluster\n end\n\n break when no existing cluster is found\n Pod1 ->> Pod1: Self-joins and create cluster\n Pod2 ->> Pod1: Joins the created cluster\n end\n end\n\n Note over Pod1,Pod2: Leader election is performed at this point\n\n Note right of Pod2: 3-7: Bootstrap process\n\n rect rgb(250, 148, 142)\n Pod1 ->> Pod2: Exchanges actor messages\n Pod2 ->> Pod1: Exchanges actor messages\n end\n\n Note right of Pod2: 8-9: Remoting\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Startup & login\n Installing on Openshift", "keywords": [ "advanced", "usage", @@ -27736,7 +27736,7 @@ "Advanced usage" ], "summary": "Advanced usage Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a container registry proxy If your installation environment re", - "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a container registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images. It is then possible to override the images being pulled by setting the global.imageRegistry key in your values.yaml file to point to your private registry:\n\n global:\n imageRegistry: <YOUR-PRIVATE-REGISTRY>\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use Kubernetes leases . We strongly recommend that you use this safety mechanism. However, the feature can be disabled by setting the leases.enabled key to false .\n\n Trusting custom CAs\n\n When your application needs to establish secure connections with services that use certificates signed by custom Certificate Authorities, you need to import these CA certificates into your system’s trust store. This documentation shows how to accomplish this using Kubernetes ConfigMaps or Secrets.\n\n 1. Import Your Custom CA Certificate\n\n Choose one of the following methods to store your CA certificate:\n\n A. Using a ConfigMap\n\n extraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n B. Using a Secret\n\n extraObjects:\n - apiVersion: v1\n kind: Secret\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: <YOUR_CA_CERTIFICATE_BASE64_ENCODED>\n\nTo encode your certificate in base64, use: cat your-ca.pem | base64 -w 0\n\n 2. Configure Your Application to Trust the CA Certificate\n\n After creating the ConfigMap or Secret with your CA certificate, configure your application to use it by setting the appropriate environment variable:\n\n A. Loading from ConfigMap\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n B. Loading from Secret\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n secretKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n Notes\n\n The SYSTEM_CA_TRUST environment variable is used by the application to add the provided certificate to the system’s trusted certificate store.\n\n You can provide multiple CA certificates by concatenating multiple certificates under a single key (ensure each certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----)\n\n Example Complete Deployment using Horizon Helm Chart\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\nextraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Figure 1. Sequence diagram of the cluster management of Horizon\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Startup & login\n Installing on Openshift", + "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a container registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images. It is then possible to override the images being pulled by setting the global.imageRegistry key in your values.yaml file to point to your private registry:\n\n global:\n imageRegistry: <YOUR-PRIVATE-REGISTRY>\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use Kubernetes leases . We strongly recommend that you use this safety mechanism. However, the feature can be disabled by setting the leases.enabled key to false .\n\n Trusting custom CAs\n\n When your application needs to establish secure connections with services that use certificates signed by custom Certificate Authorities, you need to import these CA certificates into your system’s trust store. This documentation shows how to accomplish this using Kubernetes ConfigMaps or Secrets.\n\n 1. Import Your Custom CA Certificate\n\n Choose one of the following methods to store your CA certificate:\n\n A. Using a ConfigMap\n\n extraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n B. Using a Secret\n\n extraObjects:\n - apiVersion: v1\n kind: Secret\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: <YOUR_CA_CERTIFICATE_BASE64_ENCODED>\n\nTo encode your certificate in base64, use: cat your-ca.pem | base64 -w 0\n\n 2. Configure Your Application to Trust the CA Certificate\n\n After creating the ConfigMap or Secret with your CA certificate, configure your application to use it by setting the appropriate environment variable:\n\n A. Loading from ConfigMap\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n B. Loading from Secret\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n secretKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n Notes\n\n The SYSTEM_CA_TRUST environment variable is used by the application to add the provided certificate to the system’s trusted certificate store.\n\n You can provide multiple CA certificates by concatenating multiple certificates under a single key (ensure each certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----)\n\n Example Complete Deployment using Horizon Helm Chart\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\nextraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Sequence diagram of the cluster management of Horizon\n\n sequenceDiagram\n autonumber\n rect rgb(191, 223, 255)\n Pod1 ->> Kubernetes API: Discovery request\n destroy Kubernetes API\n Kubernetes API ->> Pod1: Returns other pods addresses\n end\n Note right of Pod2: 1-2: Discovery process\n\n rect rgb(156, 250, 152)\n Pod1 ->> Pod2: Contact Pekko Management\n Pod2 ->> Pod1: Returns already contacted nodes\n\n break when an existing cluster is found\n Pod1 ->> Pod2: Joins the existing cluster\n end\n\n break when no existing cluster is found\n Pod1 ->> Pod1: Self-joins and create cluster\n Pod2 ->> Pod1: Joins the created cluster\n end\n end\n\n Note over Pod1,Pod2: Leader election is performed at this point\n\n Note right of Pod2: 3-7: Bootstrap process\n\n rect rgb(250, 148, 142)\n Pod1 ->> Pod2: Exchanges actor messages\n Pod2 ->> Pod1: Exchanges actor messages\n end\n\n Note right of Pod2: 8-9: Remoting\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Startup & login\n Installing on Openshift", "keywords": [ "advanced", "usage", @@ -28175,7 +28175,33 @@ "Horizon 2.8.5 release notes" ], "summary": "Horizon 2.8.5 release notes Here are the release notes for EverTrust Horizon v2.8.5, released on 2026-03-31. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [None] 2. Enhanceme", - "content": "Horizon 2.8.5 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.5, released on 2026-03-31.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1092] - Added Base64 and Raw functions to computation rules\n\n 3. Bug Fixes\n\n [HOR-1092] - Fixed a display issue when configuring SCIM protocol permissions\n\n [HOR-1041] - HCQL: fixed suggestions on the valid.until keyword\n\n [HOR-1004] - Fixed an issue where migration on profiles of the same module was not possible, as well as rare occurrences where the migrate button would not appear where it should\n\n [HOR-974] - Fixed an issue where Netscaler store path was not marked as mandatory on the UI\n\n [HOR-954] - Fixed an issue where SCIM profile configuration could not be saved after update\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.8.4 release notes", + "content": "Horizon 2.8.5 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.5, released on 2026-03-31.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [None]\n\n 2. Enhancements\n\n [HOR-1092] - Added Base64 and Raw functions to computation rules\n\n 3. Bug Fixes\n\n [HOR-1092] - Fixed a display issue when configuring SCIM protocol permissions\n\n [HOR-1041] - HCQL: fixed suggestions on the valid.until keyword\n\n [HOR-1004] - Fixed an issue where migration on profiles of the same module was not possible, as well as rare occurrences where the migrate button would not appear where it should\n\n [HOR-974] - Fixed an issue where Netscaler store path was not marked as mandatory on the UI\n\n [HOR-954] - Fixed an issue where SCIM profile configuration could not be saved after update\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Horizon 2.8.6 release notes\n Horizon 2.8.4 release notes", + "keywords": [ + "horizon", + "release", + "notes", + "release-notes", + "release-notes/2" + ] + }, + { + "page_id": "horizon:2.8:release-notes:2.8.6", + "product": "horizon", + "kind": "product", + "source": "antora", + "version": "2.8", + "title": "Horizon 2.8.6 release notes", + "section": "release-notes", + "slug": "release-notes/2.8.6", + "url": "https://docs.evertrust.fr/horizon/2.8/release-notes/2.8.6.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.8/release-notes/2.8.6.html", + "breadcrumbs": [ + "Horizon", + "Release notes", + "Horizon 2.8.6 release notes" + ], + "summary": "Horizon 2.8.6 release notes Here are the release notes for EverTrust Horizon v2.8.6, released on 2026-04-24. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-639] - Brainpo", + "content": "Horizon 2.8.6 release notes\n\n Here are the release notes for EverTrust Horizon v2.8.6, released on 2026-04-24.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-639] - Brainpool ECDSA elliptic curves (brainpoolp256r1, brainpoolp384r1, brainpoolp512r1) are now supported for certificate decoding, discovery, and enrollment options\n\n [HOR-1152] - A new Prometheus metric evertrust_horizon_maintenance_status is now exposed, indicating whether the instance is under maintenance\n\n 2. Enhancements\n\n [HOR-1130] - SCEP MDM profiles for Intune now support POST as GET operations\n\n 3. Bug Fixes\n\n [HOR-1147] - Fixed a UI issue where clicking the update action from the certificate detail page opened an update form in a modal instead of displaying a validation message\n\n [HOR-1176] - Fixed a UI issue where the discovery tab had a broken layout for certificates discovered by at least two campaigns\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.8.5 release notes", "keywords": [ "horizon", "release", @@ -28305,7 +28331,7 @@ "Searching requests and certificates" ], "summary": "Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority Interface 2. Access request search from the drawer: My ", - "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.8.5 release notes", + "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.8.6 release notes", "keywords": [ "searching", "requests", @@ -32817,7 +32843,7 @@ "Advanced usage" ], "summary": "Advanced usage Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes. You may find some of them below. Running behind a container registry proxy If your installation environment re", - "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a container registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images. It is then possible to override the images being pulled by setting the global.imageRegistry key in your values.yaml file to point to your private registry:\n\n global:\n imageRegistry: <YOUR-PRIVATE-REGISTRY>\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use Kubernetes leases . We strongly recommend that you use this safety mechanism. However, the feature can be disabled by setting the leases.enabled key to false .\n\n Trusting custom CAs\n\n When your application needs to establish secure connections with services that use certificates signed by custom Certificate Authorities, you need to import these CA certificates into your system’s trust store. This documentation shows how to accomplish this using Kubernetes ConfigMaps or Secrets.\n\n 1. Import Your Custom CA Certificate\n\n Choose one of the following methods to store your CA certificate:\n\n A. Using a ConfigMap\n\n extraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n B. Using a Secret\n\n extraObjects:\n - apiVersion: v1\n kind: Secret\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: <YOUR_CA_CERTIFICATE_BASE64_ENCODED>\n\nTo encode your certificate in base64, use: cat your-ca.pem | base64 -w 0\n\n 2. Configure Your Application to Trust the CA Certificate\n\n After creating the ConfigMap or Secret with your CA certificate, configure your application to use it by setting the appropriate environment variable:\n\n A. Loading from ConfigMap\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n B. Loading from Secret\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n secretKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n Notes\n\n The SYSTEM_CA_TRUST environment variable is used by the application to add the provided certificate to the system’s trusted certificate store.\n\n You can provide multiple CA certificates by concatenating multiple certificates under a single key (ensure each certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----)\n\n Example Complete Deployment using Horizon Helm Chart\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\nextraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Figure 1. Sequence diagram of the cluster management of Horizon\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Startup & login\n Installing on Openshift", + "content": "Advanced usage\n\n Some edge use-cases might not have been included in the previous installation documentation, for clarity purposes.\nYou may find some of them below.\n\n Running behind a container registry proxy\n\n If your installation environment requires you to whitelist images that can be pulled by the Kubernetes cluster, you must whitelist the registry.evertrust.io/horizon and registry.evertrust.io/horizon-upgrade images. It is then possible to override the images being pulled by setting the global.imageRegistry key in your values.yaml file to point to your private registry:\n\n global:\n imageRegistry: <YOUR-PRIVATE-REGISTRY>\n\n Leases\n\n To ensure clustering issues get resolved as fast as possible, Horizon can use Kubernetes leases . We strongly recommend that you use this safety mechanism. However, the feature can be disabled by setting the leases.enabled key to false .\n\n Trusting custom CAs\n\n When your application needs to establish secure connections with services that use certificates signed by custom Certificate Authorities, you need to import these CA certificates into your system’s trust store. This documentation shows how to accomplish this using Kubernetes ConfigMaps or Secrets.\n\n 1. Import Your Custom CA Certificate\n\n Choose one of the following methods to store your CA certificate:\n\n A. Using a ConfigMap\n\n extraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n B. Using a Secret\n\n extraObjects:\n - apiVersion: v1\n kind: Secret\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: <YOUR_CA_CERTIFICATE_BASE64_ENCODED>\n\nTo encode your certificate in base64, use: cat your-ca.pem | base64 -w 0\n\n 2. Configure Your Application to Trust the CA Certificate\n\n After creating the ConfigMap or Secret with your CA certificate, configure your application to use it by setting the appropriate environment variable:\n\n A. Loading from ConfigMap\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n B. Loading from Secret\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n secretKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\n Notes\n\n The SYSTEM_CA_TRUST environment variable is used by the application to add the provided certificate to the system’s trusted certificate store.\n\n You can provide multiple CA certificates by concatenating multiple certificates under a single key (ensure each certificate begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----)\n\n Example Complete Deployment using Horizon Helm Chart\n\n environment:\n - name: SYSTEM_CA_TRUST\n valueFrom:\n configMapKeyRef:\n name: custom-ca-certificates\n key: company-internal-ca.pem\n\nextraObjects:\n - apiVersion: v1\n kind: ConfigMap\n metadata:\n name: custom-ca-certificates\n data:\n company-internal-ca.pem: |\n -----BEGIN CERTIFICATE-----\n MIIGfjCCBGagAwIBAg...\n -----END CERTIFICATE-----\n\n Custom startup scripts\n\n Sometimes, you’ll want to run scripts each time the container starts up in order to configure files in the container or set environment variables.\nTo do so, you’ll need to mount shell scripts into the /docker-entrypoint.d/ directory in the container.\n\n Networking overview\n\n When installed in HA, Horizon sends messages to other running instances in its cluster.\nTo form the cluster and set up networking between nodes, Horizon is relying on Pekko , a framework for building clusterized applications.\nUnderstanding how clustering works is important when building deployments with highly specific needs or when preparing a disaster recovery plan.\n\n When deployed on multiple nodes inside a Kubernetes cluster, the following steps are followed:\n\n Discovery : the discovery process locates all nodes that will be used to form a cluster.\nIt relies on a third-party to give that information, such as a DNS record or the Kubernetes API (which is the default when deploying using the Helm Chart).\nFor documentation, see Pekko Discovery .\n\n Bootstrap : once each node in the cluster has the address of every other node, nodes start to contact each other.\nThis is done though Pekko Management, a tool for helping nodes coordinate.\nFor documentation, see Pekko Management .\n\n Remoting : the cluster is now formed, nodes can communicate with each other.\nThis uses Pekko Remoting, a higher level protocol for serializing data over multiple transports.\nTypically, TCP is used.\nFor documentation, see Pekko Remoting .\n\n This clustering process can be summarized by the below diagram:\n\n Sequence diagram of the cluster management of Horizon\n\n sequenceDiagram\n autonumber\n rect rgb(191, 223, 255)\n Pod1 ->> Kubernetes API: Discovery request\n destroy Kubernetes API\n Kubernetes API ->> Pod1: Returns other pods addresses\n end\n Note right of Pod2: 1-2: Discovery process\n\n rect rgb(156, 250, 152)\n Pod1 ->> Pod2: Contact Pekko Management\n Pod2 ->> Pod1: Returns already contacted nodes\n\n break when an existing cluster is found\n Pod1 ->> Pod2: Joins the existing cluster\n end\n\n break when no existing cluster is found\n Pod1 ->> Pod1: Self-joins and create cluster\n Pod2 ->> Pod1: Joins the created cluster\n end\n end\n\n Note over Pod1,Pod2: Leader election is performed at this point\n\n Note right of Pod2: 3-7: Bootstrap process\n\n rect rgb(250, 148, 142)\n Pod1 ->> Pod2: Exchanges actor messages\n Pod2 ->> Pod1: Exchanges actor messages\n end\n\n Note right of Pod2: 8-9: Remoting\n\n Traffic between different nodes is described in the below table:\n\n Table 1. Traffic detail for Horizon clustering\n\n Traffic type\n Diagram color\n Protocol\n Port\n\n Kubernetes API\n\n Blue\n\n HTTP\n\n 443\n\n Pekko Management\n\n Green\n\n HTTP\n\n 7626 (by default)\n\n Pekko Remote\n\n Red\n\n TCP (by default)\n\n 17355\n\n Startup & login\n Installing on Openshift", "keywords": [ "advanced", "usage", @@ -33148,7 +33174,33 @@ "Horizon 2.9.0 release notes" ], "summary": "Horizon 2.9.0 release notes Here are the release notes for EverTrust Horizon v2.9.0, released on 2026-03-13. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-541] - Added m", - "content": "Horizon 2.9.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.0, released on 2026-03-13.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-541] - Added multi-tenancy support\n\n 2. Enhancements\n\n None\n\n 3. Bug Fixes\n\n None\n\n 4. Known Defects\n\n None\n\n 5. API modifications\n\n [HOR-541] - Renamed field tenant to azureTenant in AKV configuration objects ( Third Party AKV Connector , MDM Intune Connector , MDM Intune PKCS Connector )\n\n Searching requests and certificates\n Configure tunnels", + "content": "Horizon 2.9.0 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.0, released on 2026-03-13.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-541] - Added multi-tenancy support\n\n 2. Enhancements\n\n None\n\n 3. Bug Fixes\n\n None\n\n 4. Known Defects\n\n None\n\n 5. API modifications\n\n [HOR-541] - Renamed field tenant to azureTenant in AKV configuration objects ( Third Party AKV Connector , MDM Intune Connector , MDM Intune PKCS Connector )\n\n Horizon 2.9.1 release notes\n Configure tunnels", + "keywords": [ + "horizon", + "release", + "notes", + "release-notes", + "release-notes/2" + ] + }, + { + "page_id": "horizon:2.9:release-notes:2.9.1", + "product": "horizon", + "kind": "product", + "source": "antora", + "version": "2.9", + "title": "Horizon 2.9.1 release notes", + "section": "release-notes", + "slug": "release-notes/2.9.1", + "url": "https://docs.evertrust.fr/horizon/2.9/release-notes/2.9.1.html", + "canonical_url": "https://docs.evertrust.fr/horizon/2.9/release-notes/2.9.1.html", + "breadcrumbs": [ + "Horizon", + "Release notes", + "Horizon 2.9.1 release notes" + ], + "summary": "Horizon 2.9.1 release notes Here are the release notes for EverTrust Horizon v2.9.1, released on 2026-04-27. For the installation and upgrade procedure, please refer to the Installation and Upgrade guide. 1. New Features [HOR-1240] - Brainp", + "content": "Horizon 2.9.1 release notes\n\n Here are the release notes for EverTrust Horizon v2.9.1, released on 2026-04-27.\n\n For the installation and upgrade procedure, please refer to the Installation and Upgrade guide.\n\n 1. New Features\n\n [HOR-1240] - Brainpool ECDSA elliptic curves (brainpoolp256r1, brainpoolp384r1, brainpoolp512r1) are now supported for certificate decoding, discovery, and enrollment options\n\n [HOR-1161] - SCEP MDM profiles for Intune now support POST as GET operations\n\n [HOR-1154] - A new Prometheus metric evertrust_horizon_maintenance_status is now exposed, indicating whether the instance is under maintenance\n\n 2. Enhancements\n\n [None]\n\n 3. Bug Fixes\n\n [HOR-1251] - Fixed an issue where loading a PKCS#11 wrapped Tink keyset could result in a fatal error when using specific HSMs\n\n [HOR-1149] - Fixed a UI issue where clicking the update action from the certificate detail page opened an update form in a modal instead of displaying a validation message\n\n [HOR-1041] - Fixed an issue where HCQL requests did not offer the correct choices after typing a compound query such as status is expired and valid.until\n\n [HOR-1039] - Fixed an issue where accessing the root URL of a multitenant instance in maintenance mode resulted in a timeout instead of redirecting to the maintenance page\n\n [HOR-995] - Fixed an issue where creating multiple Intune PKCS connectors with empty search filters was denied\n\n 4. Known Defects\n\n [None]\n\n 5. API modifications\n\n [None]\n\n Searching requests and certificates\n Horizon 2.9.0 release notes", "keywords": [ "horizon", "release", @@ -33278,7 +33330,7 @@ "Searching requests and certificates" ], "summary": "Search Request Here is the section where you can search easily find all information regarding the request. How to do a simple request search 1. Log in to Horizon Registration Authority Interface 2. Access request search from the drawer: My ", - "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.9.0 release notes", + "content": "Search Request\n\n Here is the section where you can search easily find all information regarding the request.\n\n How to do a simple request search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access request search from the drawer: My request or Request dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in request DNs (string input) :\n\nEnter the Certificate DNs you are looking for in a request\n\n Search in IDs (string input) :\n\nEnter the IDs you are looking for in a request\n\n Search in Requester (string input) :\n\nEnter the Requester you are looking for in a request\n\n Search in Protocols (string input) :\n\nSelect the Protocols you are looking for in a request\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a request\n\n Include workflow (string select) :\n\nSelect if the workflow you are looking in a request\n\n Include expired requests (string select) :\n\nSelect if the request you are looking is expired\n\n 4. Click on the filter button\n\n You can reset the search by clicking on reset button\n\n Search Certificate\n\n Here is the section where you can search easily find all information regarding the certificate.\n\n How to do a simple certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certificate search from the drawer: My certificates or Search certificates or Certificates dashboard\n\n 3. Fill in the information you want to look at:\n\n Search in DNs (string input) :\n\nEnter the DNs you are looking for in a certificate\n\n Search in SANs (string input) :\n\nEnter the SANs you are looking for in a certificate\n\n Search in serials (string input) :\n\nEnter the serials you are looking for in a certificate\n\n Search in issuer DNs (string input) :\n\nEnter the issuer DNs you are looking for in a certificate\n\n Expiration date start (string input) :\n\nEnter the expiration date start you are looking for in a certificate\n\n Expiration end start (string input) :\n\nEnter the expiration end start you are looking for in a certificate\n\n Search in profiles (string input) :\n\nEnter the profile you are looking for in a certificate\n\n Search in modules (string select multiple) :\n\nSelect the module you are looking for in a certificate\n\n Search in Discovery campaigns (string input) :\n\nEnter the discovery campaigns you are looking for in a certificate\n\n Include status (string select multiple) :\n\nSelect the status you are looking for in a certificate\n\n Include signed (string select) :\n\nSelect if the certificate you are looking is Self-Signed or Not Self-Signed or all\n\n Include discovery (string select) :\n\nSelect if the certificate you are looking is Discovered trusted or Discovered not trusted\n\n 4. Click on the search button\n\n You can reset the search by clicking on reset button or try the expert mode by clicking on expert mode button\n\n How to do an expert certificate search\n\n 1. Log in to Horizon Registration Authority Interface\n\n 2. Access certification search from the drawer: My certificates or Search certificate or Certificate dashboard\n\n 3. Enter your research line.\n\n To do so you will need to click on the input field. A list appears and you will be able to choose between all selector, then condition, then field, and you can add an operator to refine the search.\n\n Element * (string input) :\n\nEnter the element you are looking for in a certificate\n\n Condition * (string input) :\n\nEnter the condition you are looking for in a certificate for this element\n\n Field * (string input) :\n\nEnter the name of the element\n\n Operation * (string input) :\n\nChoose an operator if you want to refine your search\n\n Certificate Search Structure\n\n <element> <condition> <\"name\"> (<operator> [<element> <condition> <\"name\">])\n\n Table 1. Table element\n\n Name\n Type\n Description\n\n dn\n\n string\n\n Distinguished name\n\n san\n\n string\n\n Subject Alternative name\n\n serial\n\n string\n\n Certificate serial number\n\n issuer\n\n string\n\n Issuer distinguished name\n\n status\n\n string\n\n Certificate status\n\n module\n\n string\n\n Certificate module\n\n profile\n\n string\n\n Certificate profile\n\n valid.until\n\n date\n\n Certificate 'not after' date\n\n valid.from\n\n date\n\n Certificate 'not before' date\n\n keytype\n\n string\n\n Certificate key type\n\n signingalgorithm\n\n string\n\n Certificate signing algorithm\n\n owner\n\n string\n\n Certificate owner\n\n holderid\n\n string\n\n Certificate holder ID\n\n metadata.contact_email\n\n string\n\n Contact email\n\n metadata.pki_connector\n\n string\n\n PKI Connector\n\n label.\n\n string\n\n Label\n\n discoveryinfo.campaign\n\n string\n\n Discovery campaign\n\n discoverydata.ip\n\n string\n\n Discovery IP\n\n discoverydata.hostnames\n\n string\n\n Discovery Hostnames\n\n discoverydata.tls.port\n\n int\n\n Discovery TLS port\n\n discoverydata.tls.version\n\n string\n\n Discovery TLS version\n\n discoverydata.operatingsystems\n\n string\n\n Discovery TLS version\n\n discoverydata.sources\n\n string\n\n Discovery TLS version\n\n thirdparty.id\n\n string\n\n Third-Party ID\n\n thirdparty.connector\n\n string\n\n Third-Party connector\n\n thirdparty.fingerprint\n\n string\n\n Third-Party fingerprint\n\n Table 2. Table condition combination\n\n Name\n Description\n\n contains\n\n Field contains the specified value (case insensitive)\n\n not contains\n\n Criteria does not contain\n\n equals\n\n Criteria exactly equals to\n\n not equals\n\n Criteria exactly not equals\n\n in\n\n Criteria exactly in the following array\n\n not in\n\n Criteria exactly not in the following array\n\n within\n\n Criteria contain in the following array\n\n not within\n\n Criteria contain not in the following array\n\n Table 3. Table operation combination\n\n Name\n Description\n\n and\n\n Evaluate a AND logical operation on two criteria or set of criteria\n\n or\n\n Evaluate a OR logical operation on two criteria or set of criteria\n\n Name\n Contains\n Not contains\n Equals\n Not equals\n In\n Not in\n Within\n Not within\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n Name (part 2)\n\n Is\n\n Before\n\n After\n\n Exists\n\n dn\n\n san\n\n serial\n\n issuer\n\n status\n\n module\n\n profile\n\n valid.until\n\n valid.from\n\n keytype\n\n signingalgorithm\n\n owner\n\n holderid\n\n metadata.contact_email\n\n metadata.pki_connector\n\n label.\n\n discoveryinfo.campaign\n\n discoverydata.ip\n\n discoverydata.hostnames\n\n discoverydata.tls.port\n\n discoverydata.tls.version\n\n discoverydata.operatingsystems\n\n discoverydata.sources\n\n thirdparty.id\n\n thirdparty.connector\n\n thirdparty.fingerprint\n\n 4. Click on the search button\n\n Managing requests (operator)\n Horizon 2.9.1 release notes", "keywords": [ "searching", "requests", diff --git a/src/resources/knowledge/query_languages.md b/src/resources/knowledge/query_languages.md index 3f57929..7baadfe 100644 --- a/src/resources/knowledge/query_languages.md +++ b/src/resources/knowledge/query_languages.md @@ -450,6 +450,73 @@ NOT HCQL query field names (`valid.until`, `valid.from`). --- +## Pagination (search_certificates, search_requests, search_events, search_discovery_events) + +All paginated search tools share the same contract. Read this once and apply it +everywhere. + +### Inputs + +| Parameter | Type | Default | Meaning | +| ------------ | ------- | ------- | ------------------------------------------------ | +| `page_index` | int ≥ 0 | `0` | **0-based** page. First page is 0. | +| `page_size` | int | `25` | Page size, capped server-side at 100. | +| `sorted_by` | string | (none) | e.g. `notAfter:Desc`. Required for stable pages. | +| `with_count` | bool | `true` | Include total count; leave on for planning. | + +### Response envelope + +Every paginated search tool returns the same shape: + +```json +{ + "results": [ ... ], + "page_index": 0, + "page_size": 100, + "total": 187, + "has_more": true, + "next_page_index": 1 +} +``` + +- `page_index` echoes back the 0-based index you requested. +- `total` is the full match count (`null` if `with_count=false`). +- `has_more` is deterministic: `true` when another page exists. +- `next_page_index` is `page_index + 1` when `has_more`, else `null`. + +### How to iterate (canonical protocol) + +1. Call the search with `page_index=0` (and optionally `sorted_by`). +2. Read `next_page_index` from the response. +3. If `next_page_index` is `null` or `has_more` is `false`, stop. +4. Otherwise, call again with `page_index = next_page_index`. Do **not** + increment `page_index` yourself from a remembered value: always use + `next_page_index` from the latest response. This avoids off-by-one bugs + even if the server skipped a page or the requested size was capped. + +### Stable ordering + +Without `sorted_by`, the server is free to reorder rows between requests and +the same record may appear on multiple pages (or be skipped). Always pass a +`sorted_by` on a unique or near-unique column when paginating through more +than one page -- `notAfter:Desc`, `registrationDate:Desc`, `timestamp:Desc`, +or `_id:Asc` are safe defaults. + +### Common pitfalls + +- **Response field names are snake_case** (`page_index`, `has_more`, + `next_page_index`) to match tool inputs. Do not echo the camelCase API + names (`pageIndex`, `hasMore`) -- those go to Horizon, not back to you. +- **Do not reuse a previous `page_index` input if the call failed** -- always + re-read `next_page_index` from the last successful response. +- **`page_size > 100` is capped to 100 server-side**; use the `page_size` + field in the response to know the actual size. +- **Invalid `page_index` (negative, non-integer) raises a + `PAGINATION-BAD-INDEX` error** -- this is intentional; do not silently + retry with 0. + +--- + ## HCQL vs API Field Names (CRITICAL) HCQL query fields and API response/request fields use **different naming conventions**. diff --git a/src/tools/discovery-events.ts b/src/tools/discovery-events.ts index daaa5df..8017a3e 100644 --- a/src/tools/discovery-events.ts +++ b/src/tools/discovery-events.ts @@ -18,6 +18,7 @@ import { CSV_TIMEOUT, buildExportPayload, buildSearchPayload, + buildSearchResponse, csvTruncationMetadata, } from './helpers.js'; import { registerTool } from './register.js'; @@ -52,7 +53,14 @@ export function registerDiscoveryEventTools( ' sessionid equals "scan-session-id"\n' + 'Full reference: horizon://knowledge/query-languages\n\n' + 'HDQL fields: timestamp, certificateid, sessionid, error.code, client.*\n' + - "sorted_by format: 'element' or 'element:Desc'.", + "sorted_by format: 'element' or 'element:Desc'.\n\n" + + 'Pagination protocol (READ CAREFULLY):\n' + + ' - page_index is 0-based. First page is page_index=0.\n' + + ' - Response always includes has_more and next_page_index.\n' + + ' - To fetch the next page: call again with page_index = next_page_index.\n' + + ' - Stop when has_more=false or next_page_index=null.\n' + + ' - Pass sorted_by (e.g. timestamp:Desc) for deterministic ordering.\n' + + ' - with_count=true (default) surfaces total for up-front sizing.', inputSchema: z.object({ query: z.string().describe('HDQL query string.'), page_index: z @@ -60,7 +68,9 @@ export function registerDiscoveryEventTools( .int() .min(0) .default(0) - .describe('Zero-based page index (default 0).'), + .describe( + 'Page index (0-based). Use next_page_index from the previous response to paginate.', + ), page_size: z .number() .int() @@ -71,11 +81,15 @@ export function registerDiscoveryEventTools( sorted_by: z .string() .optional() - .describe("Sort specification, e.g. 'timestamp:Desc'."), + .describe( + "Sort specification, e.g. 'timestamp:Desc'. Strongly recommended when paginating.", + ), with_count: z .boolean() - .default(false) - .describe('Include total count in response (slower).'), + .default(true) + .describe( + 'Include total matching count in response so has_more/next_page_index are reliable. Default true.', + ), enable_analytics: z .boolean() .default(true) @@ -103,15 +117,12 @@ export function registerDiscoveryEventTools( `?enableAnalytics=${String(enable_analytics).toLowerCase()}`; const result = await client.post>(path, payload); - const records = (result['results'] ?? result['items'] ?? []) as Record< - string, - unknown - >[]; - const response: Record = { results: records }; - if ('count' in result) response['count'] = result['count']; - if ('hasMore' in result) response['hasMore'] = result['hasMore']; - response['pageIndex'] = page_index; - response['pageSize'] = Math.min(page_size, 100); + // truncate: false -- same reasoning as search_events. The shared + // truncation hint names get_certificate; the correct recovery tool + // for discovery events is get_discovery_event. + const response = buildSearchResponse(result, page_index, page_size, { + truncate: false, + }); return { content: [{ type: 'text' as const, text: JSON.stringify(response) }], diff --git a/src/tools/helpers.ts b/src/tools/helpers.ts index 71a6bb6..d24fbcf 100644 --- a/src/tools/helpers.ts +++ b/src/tools/helpers.ts @@ -271,7 +271,14 @@ export function buildSortedBy( } export function toApiPageIndex(pageIndex: number): number { - return Math.max(1, pageIndex + 1); + if (!Number.isInteger(pageIndex) || pageIndex < 0) { + throw new HorizonError(400, { + errorCode: 'PAGINATION-BAD-INDEX', + message: `page_index must be a non-negative integer, got ${pageIndex}.`, + remediation: 'Pass page_index >= 0 (0 for the first page).', + }); + } + return pageIndex + 1; } export function buildSearchPayload( @@ -295,6 +302,65 @@ export function buildSearchPayload( return payload; } +/** + * Build a standardized pagination response envelope for paginated search tools. + * + * Returns a consistent shape so models (including smaller/less capable ones) + * never need to translate between camelCase API fields and snake_case MCP + * inputs, and always get an explicit next_page_index / has_more signal. + * + * Fields: + * - results: array of records from the current page + * - page_index: 0-based index of the page just returned (matches MCP input) + * - page_size: number of results requested for this page (capped at MAX_PAGE_SIZE) + * - total: total matching records when known (with_count=true), else null + * - has_more: true if another page is available + * - next_page_index: page_index + 1 if has_more, else null + * + * Options: + * - truncate: apply field-level truncation to each record. Default true for + * certificate and request searches (where large fields like raw PEM, + * extensions, and metadata blobs blow context windows). Event-oriented + * tools should pass `truncate: false` because the truncation messages + * name `get_certificate` as the recovery path, which is wrong for events. + */ +export function buildSearchResponse( + result: Record, + pageIndex: number, + pageSize: number, + options: { truncate?: boolean } = {}, +): Record { + const { truncate = true } = options; + const cappedPageSize = Math.min(pageSize, MAX_PAGE_SIZE); + const rawRecords = (result['results'] ?? result['items'] ?? []) as unknown; + const records = Array.isArray(rawRecords) + ? truncate + ? (rawRecords as Record[]).map(truncateRecord) + : (rawRecords as Record[]) + : []; + + const total = + typeof result['count'] === 'number' ? (result['count'] as number) : null; + + let hasMore: boolean; + if (typeof result['hasMore'] === 'boolean') { + hasMore = result['hasMore'] as boolean; + } else if (total !== null) { + hasMore = (pageIndex + 1) * cappedPageSize < total; + } else { + hasMore = records.length >= cappedPageSize; + } + + return { + results: records, + page_index: pageIndex, + page_size: cappedPageSize, + total, + has_more: hasMore, + next_page_index: hasMore ? pageIndex + 1 : null, + }; +} + export function buildExportPayload( query: string, fields?: string[], diff --git a/src/tools/lifecycle.ts b/src/tools/lifecycle.ts index fedb439..13fded8 100644 --- a/src/tools/lifecycle.ts +++ b/src/tools/lifecycle.ts @@ -21,11 +21,9 @@ import { REQUEST_PRESETS, buildExportPayload, buildSearchPayload, - buildSortedBy, + buildSearchResponse, csvTruncationMetadata, preflightRequestAction, - toApiPageIndex, - truncateRecord, } from './helpers.js'; import { registerTool } from './register.js'; @@ -265,7 +263,18 @@ export function registerLifecycleTools( 'Full reference: horizon://knowledge/query-languages (Ownership Patterns section).\n\n' + 'See also: whoami (get identity + teams for ownership queries),\n' + ' get_certificate (full details by ID), aggregate_certificates (group-by analytics),\n' + - ' export_certificates_csv (bulk CSV export).', + ' export_certificates_csv (bulk CSV export).\n\n' + + 'Pagination protocol (READ CAREFULLY):\n' + + ' - page_index is 0-based. First page is page_index=0.\n' + + ' - Response always includes has_more (boolean) and next_page_index\n' + + ' (0-based integer or null if no more pages).\n' + + ' - To fetch the next page: call again with page_index = next_page_index.\n' + + ' - Stop when has_more=false or next_page_index=null.\n' + + ' - For deterministic ordering across pages, ALWAYS pass sorted_by;\n' + + ' without it the server may reorder rows between requests and you\n' + + ' will see duplicates or miss records.\n' + + ' - with_count=true (default) surfaces total in the response so you\n' + + ' know up-front how many pages to expect.', inputSchema: z.object({ query: z.string().describe('HCQL query expression.'), preset: z @@ -281,7 +290,9 @@ export function registerLifecycleTools( .int() .min(0) .default(0) - .describe('Page index (0-based).'), + .describe( + 'Page index (0-based). Use next_page_index from the previous response to paginate.', + ), page_size: z .number() .int() @@ -292,11 +303,15 @@ export function registerLifecycleTools( sorted_by: z .string() .optional() - .describe("Sort field, e.g. 'notAfter' or 'notAfter:Desc'."), + .describe( + "Sort field, e.g. 'notAfter' or 'notAfter:Desc'. Strongly recommended when paginating.", + ), with_count: z .boolean() - .default(false) - .describe('Include total count in response.'), + .default(true) + .describe( + 'Include total matching count in response so has_more/next_page_index are reliable. Default true.', + ), }), }, async ({ @@ -323,19 +338,7 @@ export function registerLifecycleTools( payload, ); - let records = (result['results'] ?? result['items'] ?? []) as Record< - string, - unknown - >[]; - if (Array.isArray(records)) { - records = records.map(truncateRecord); - } - - const response: Record = { results: records }; - if ('count' in result) response['count'] = result['count']; - if ('hasMore' in result) response['hasMore'] = result['hasMore']; - response['pageIndex'] = page_index; - response['pageSize'] = Math.min(page_size, 100); + const response = buildSearchResponse(result, page_index, page_size); return { content: [{ type: 'text' as const, text: JSON.stringify(response) }], @@ -911,7 +914,15 @@ export function registerLifecycleTools( ' owner, profile, registrationDate, releaseAt, requester,\n' + ' requesterComment, status, team, workflow\n\n' + 'See also: get_request (full details by ID), aggregate_requests (group-by analytics),\n' + - ' export_requests_csv (bulk CSV export).', + ' export_requests_csv (bulk CSV export).\n\n' + + 'Pagination protocol (READ CAREFULLY):\n' + + ' - page_index is 0-based. First page is page_index=0.\n' + + ' - Response always includes has_more and next_page_index.\n' + + ' - To fetch the next page: call again with page_index = next_page_index.\n' + + ' - Stop when has_more=false or next_page_index=null.\n' + + ' - Pass sorted_by for deterministic ordering across pages.\n' + + ' - with_count=true (default) makes total available so the model\n' + + ' knows up-front how many pages to expect.', inputSchema: z.object({ query: z.string().describe('HRQL query expression.'), preset: z @@ -927,7 +938,9 @@ export function registerLifecycleTools( .int() .min(0) .default(0) - .describe('Page index (0-based).'), + .describe( + 'Page index (0-based). Use next_page_index from the previous response to paginate.', + ), page_size: z .number() .int() @@ -938,11 +951,15 @@ export function registerLifecycleTools( sorted_by: z .string() .optional() - .describe("Sort field, e.g. 'registrationDate:Desc'."), + .describe( + "Sort field, e.g. 'registrationDate:Desc'. Strongly recommended when paginating.", + ), with_count: z .boolean() - .default(false) - .describe('Include total count in response.'), + .default(true) + .describe( + 'Include total matching count in response so has_more/next_page_index are reliable. Default true.', + ), }), }, async ({ @@ -969,19 +986,7 @@ export function registerLifecycleTools( payload, ); - let records = (result['results'] ?? result['items'] ?? []) as Record< - string, - unknown - >[]; - if (Array.isArray(records)) { - records = records.map(truncateRecord); - } - - const response: Record = { results: records }; - if ('count' in result) response['count'] = result['count']; - if ('hasMore' in result) response['hasMore'] = result['hasMore']; - response['pageIndex'] = page_index; - response['pageSize'] = Math.min(page_size, 100); + const response = buildSearchResponse(result, page_index, page_size); return { content: [{ type: 'text' as const, text: JSON.stringify(response) }], @@ -1075,7 +1080,14 @@ export function registerLifecycleTools( "sorted_by format: 'element' or 'element:Desc'.\n" + 'Sortable elements: _id, code, module, node, timestamp, removeAt, status\n\n' + 'Results are paginated. Events capture all certificate lifecycle actions\n' + - 'including enrollments, revocations, approvals, and configuration changes.', + 'including enrollments, revocations, approvals, and configuration changes.\n\n' + + 'Pagination protocol (READ CAREFULLY):\n' + + ' - page_index is 0-based. First page is page_index=0.\n' + + ' - Response always includes has_more and next_page_index.\n' + + ' - To fetch the next page: call again with page_index = next_page_index.\n' + + ' - Stop when has_more=false or next_page_index=null.\n' + + ' - Pass sorted_by (e.g. timestamp:Desc) for deterministic ordering across pages.\n' + + ' - with_count=true (default) surfaces total so you know the full span.', inputSchema: z.object({ query: z.string().describe('HEQL query expression.'), page_index: z @@ -1083,7 +1095,9 @@ export function registerLifecycleTools( .int() .min(0) .default(0) - .describe('Page index (0-based).'), + .describe( + 'Page index (0-based). Use next_page_index from the previous response to paginate.', + ), page_size: z .number() .int() @@ -1094,33 +1108,39 @@ export function registerLifecycleTools( sorted_by: z .string() .optional() - .describe("Sort field, e.g. 'timestamp:Desc'."), + .describe( + "Sort field, e.g. 'timestamp:Desc'. Strongly recommended when paginating.", + ), + with_count: z + .boolean() + .default(true) + .describe( + 'Include total matching count in response so has_more/next_page_index are reliable. Default true.', + ), }), }, - async ({ query, page_index, page_size, sorted_by }) => { - const cappedPageSize = Math.min(page_size, 100); - const payload: Record = { + async ({ query, page_index, page_size, sorted_by, with_count }) => { + const payload = buildSearchPayload( query, - pageIndex: toApiPageIndex(page_index), - pageSize: cappedPageSize, - }; - const sorted = buildSortedBy(sorted_by); - if (sorted) payload['sortedBy'] = sorted; + undefined, + page_index, + page_size, + sorted_by, + with_count, + ); const result = await client.post>( '/api/v1/events/search', payload, ); - const records = (result['results'] ?? result['items'] ?? []) as Record< - string, - unknown - >[]; - const response: Record = { results: records }; - if ('count' in result) response['count'] = result['count']; - if ('hasMore' in result) response['hasMore'] = result['hasMore']; - response['pageIndex'] = page_index; - response['pageSize'] = cappedPageSize; + // truncate: false -- event records (details.*, client.*) must stay + // intact, and the shared truncateRecord message names get_certificate + // as the recovery tool, which is wrong here. Recovery path is + // get_event. + const response = buildSearchResponse(result, page_index, page_size, { + truncate: false, + }); return { content: [{ type: 'text' as const, text: JSON.stringify(response) }], diff --git a/tests/e2e/docs.test.ts b/tests/e2e/docs.test.ts index 45458b4..253850f 100644 --- a/tests/e2e/docs.test.ts +++ b/tests/e2e/docs.test.ts @@ -123,14 +123,14 @@ describe.skipIf(!E2E_CONFIGURED)('Documentation tools E2E', () => { max_results: 3, }); - expect(search['resolved_product_version']).toBe('0.4.0'); + expect(search['resolved_product_version']).toBe('0.5.0'); const results = search['results'] as Array>; expect(results[0]?.['page_id']).toBe( - 'terraform-provider-horizon:0.4.0:certificate', + 'terraform-provider-horizon:0.5.0:certificate', ); const page = await callTool('get_doc_page', { - page_id: 'terraform-provider-horizon:0.4.0:certificate', + page_id: 'terraform-provider-horizon:0.5.0:certificate', }); expect(page['title']).toBe('horizon_certificate Resource'); diff --git a/tests/e2e/horizon.test.ts b/tests/e2e/horizon.test.ts index b50ffbc..af597bd 100644 --- a/tests/e2e/horizon.test.ts +++ b/tests/e2e/horizon.test.ts @@ -65,11 +65,16 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { `Got: ${Object.keys(result).join(', ')}`, ).toBeDefined(); expect(Array.isArray(result['results'])).toBe(true); - expect(result['pageIndex']).toBeDefined(); - expect(result['pageSize']).toBeDefined(); + // Standardized pagination envelope: snake_case keys matching the + // tool inputs, plus explicit has_more / next_page_index hints so + // models don't have to derive pagination state themselves. + expect(result['page_index']).toBeDefined(); + expect(result['page_size']).toBeDefined(); + expect(result).toHaveProperty('has_more'); + expect(result).toHaveProperty('next_page_index'); }); - it('returns count when with_count is requested', async () => { + it('returns total when with_count is requested', async () => { const result = await callTool('search_certificates', { query: 'profile exists', page_size: 5, @@ -78,8 +83,8 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { expect(result['results']).toBeDefined(); expect(Array.isArray(result['results'])).toBe(true); expect( - result['count'], - "with_count=true should populate 'count'", + result['total'], + "with_count=true should populate 'total'", ).toBeDefined(); }); @@ -286,7 +291,9 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { `search_requests response lacks 'results'. Got: ${Object.keys(result).join(', ')}`, ).toBeDefined(); expect(Array.isArray(result['results'])).toBe(true); - expect(result['pageIndex']).toBeDefined(); + expect(result['page_index']).toBeDefined(); + expect(result).toHaveProperty('has_more'); + expect(result).toHaveProperty('next_page_index'); }); it('gets a request by ID', async () => { @@ -2084,8 +2091,10 @@ describe.skipIf(!E2E_CONFIGURED)('Horizon E2E', () => { }); expect(data['results']).toBeDefined(); expect(Array.isArray(data['results'])).toBe(true); - expect(data['pageIndex']).toBeDefined(); - expect(data['pageSize']).toBeDefined(); + expect(data['page_index']).toBeDefined(); + expect(data['page_size']).toBeDefined(); + expect(data).toHaveProperty('has_more'); + expect(data).toHaveProperty('next_page_index'); }); it('get_discovery_event returns details for an available event', async () => { diff --git a/tests/unit/__snapshots__/golden.test.ts.snap b/tests/unit/__snapshots__/golden.test.ts.snap index aee1aa3..e8eb9d4 100644 --- a/tests/unit/__snapshots__/golden.test.ts.snap +++ b/tests/unit/__snapshots__/golden.test.ts.snap @@ -1642,7 +1642,7 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` "type": "string", }, "with_count": { - "default": false, + "default": true, "type": "boolean", }, }, @@ -1676,7 +1676,7 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` "type": "string", }, "with_count": { - "default": false, + "default": true, "type": "boolean", }, }, @@ -1730,6 +1730,10 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` "sorted_by": { "type": "string", }, + "with_count": { + "default": true, + "type": "boolean", + }, }, "required": [ "query", @@ -1772,7 +1776,7 @@ exports[`Golden tests > tool schemas match snapshot 1`] = ` "type": "string", }, "with_count": { - "default": false, + "default": true, "type": "boolean", }, }, diff --git a/tests/unit/docs.test.ts b/tests/unit/docs.test.ts index 1764a1d..86f34fa 100644 --- a/tests/unit/docs.test.ts +++ b/tests/unit/docs.test.ts @@ -196,7 +196,7 @@ describe('Documentation tools', () => { const client = await createDocsToolClient(createMockClient()); const result = await callJsonTool(client, 'get_doc_page', { - page_id: 'terraform-provider-horizon:0.4.0:certificate', + page_id: 'terraform-provider-horizon:0.5.0:certificate', }); expect(result['title']).toBe('horizon_certificate Resource'); diff --git a/tests/unit/helpers.test.ts b/tests/unit/helpers.test.ts index 7b53c4a..af3c9cd 100644 --- a/tests/unit/helpers.test.ts +++ b/tests/unit/helpers.test.ts @@ -6,9 +6,11 @@ import { buildExportPayload, buildListResponse, buildSearchPayload, + buildSearchResponse, buildSortedBy, csvTruncationMetadata, deleteGuard, + toApiPageIndex, truncateRecord, } from '../../src/tools/helpers.js'; @@ -241,6 +243,181 @@ describe('buildSearchPayload', () => { }); }); +describe('toApiPageIndex', () => { + it('converts 0-based MCP index to 1-based API index', () => { + expect(toApiPageIndex(0)).toBe(1); + expect(toApiPageIndex(1)).toBe(2); + expect(toApiPageIndex(42)).toBe(43); + }); + + // Previously this function used Math.max(1, pageIndex+1) which silently + // clamped bad input. Silent clamping masked real caller bugs and + // contributed to hard-to-debug "same page" reports. Validate explicitly. + it('rejects negative indices with PAGINATION-BAD-INDEX', () => { + try { + toApiPageIndex(-1); + expect.fail('should have thrown'); + } catch (err) { + expect(err).toBeInstanceOf(HorizonError); + expect((err as HorizonError).errorCode).toBe('PAGINATION-BAD-INDEX'); + } + }); + + it('rejects non-integer indices', () => { + expect(() => toApiPageIndex(1.5)).toThrow(HorizonError); + expect(() => toApiPageIndex(Number.NaN)).toThrow(HorizonError); + }); +}); + +describe('buildSearchResponse', () => { + it('returns the canonical envelope shape', () => { + const envelope = buildSearchResponse( + { results: [{ _id: 'a' }], count: 100 }, + 0, + 25, + ); + + expect(envelope).toHaveProperty('results'); + expect(envelope).toHaveProperty('page_index', 0); + expect(envelope).toHaveProperty('page_size', 25); + expect(envelope).toHaveProperty('total', 100); + expect(envelope).toHaveProperty('has_more'); + expect(envelope).toHaveProperty('next_page_index'); + // Legacy camelCase names must not leak through -- mixing them with the + // snake_case tool inputs is what confused models in the bug report. + expect(envelope).not.toHaveProperty('pageIndex'); + expect(envelope).not.toHaveProperty('pageSize'); + expect(envelope).not.toHaveProperty('hasMore'); + expect(envelope).not.toHaveProperty('count'); + }); + + it('computes has_more from total when count is present', () => { + // 2 pages of 100 in a 187-total set -> page 0 has more, page 1 does not. + const first = buildSearchResponse( + { results: new Array(100).fill({ _id: 'x' }), count: 187 }, + 0, + 100, + ); + const second = buildSearchResponse( + { results: new Array(87).fill({ _id: 'x' }), count: 187 }, + 1, + 100, + ); + + expect(first['has_more']).toBe(true); + expect(first['next_page_index']).toBe(1); + expect(second['has_more']).toBe(false); + expect(second['next_page_index']).toBeNull(); + }); + + it('honours the API hasMore signal when provided', () => { + const env = buildSearchResponse( + { results: [{ _id: 'x' }], hasMore: true }, + 0, + 25, + ); + expect(env['has_more']).toBe(true); + expect(env['next_page_index']).toBe(1); + }); + + it('falls back to page fullness heuristic when no count / hasMore', () => { + // A full page -> probably more rows; a partial page -> definitely last. + const full = buildSearchResponse( + { results: new Array(25).fill({ _id: 'x' }) }, + 0, + 25, + ); + const partial = buildSearchResponse( + { results: new Array(7).fill({ _id: 'x' }) }, + 0, + 25, + ); + + expect(full['has_more']).toBe(true); + expect(partial['has_more']).toBe(false); + expect(partial['next_page_index']).toBeNull(); + }); + + it('sets total to null when the API omitted count', () => { + const env = buildSearchResponse({ results: [] }, 0, 25); + expect(env['total']).toBeNull(); + }); + + it('caps page_size reported in envelope at MAX_PAGE_SIZE', () => { + const env = buildSearchResponse({ results: [] }, 0, 500); + expect(env['page_size']).toBe(100); + }); + + it('accepts both results and items as the record array', () => { + const viaItems = buildSearchResponse( + { items: [{ _id: 'a' }], count: 1 }, + 0, + 25, + ); + expect((viaItems['results'] as unknown[]).length).toBe(1); + }); + + // Regression guard for the event-search truncation bug surfaced in code + // review: buildSearchResponse used to unconditionally apply the + // cert-specific truncateRecord hints ("use get_certificate") to every + // caller. Event tools must be able to opt out so their large detail + // blobs are preserved and no misleading recovery tool is suggested. + it('truncate:false preserves large string fields untouched', () => { + const bigString = 'x'.repeat(2000); // well above MAX_STRING_LEN + const env = buildSearchResponse( + { results: [{ detail: bigString }], count: 1 }, + 0, + 25, + { truncate: false }, + ); + const first = (env['results'] as Record[])[0]!; + expect(first['detail']).toBe(bigString); + expect(String(first['detail'])).not.toContain('get_certificate'); + }); + + it('truncate:true (default) still applies record-level truncation', () => { + const bigString = 'x'.repeat(2000); + const env = buildSearchResponse( + { results: [{ detail: bigString }], count: 1 }, + 0, + 25, + ); + const first = (env['results'] as Record[])[0]!; + expect(first['detail']).not.toBe(bigString); + expect(String(first['detail']).length).toBeLessThan(bigString.length); + }); + + // Regression guard: two consecutive page_index values MUST produce + // envelopes that advertise different next_page_index values. This is the + // direct assertion against the reported "pagination returned the same + // page" failure mode. + it('advances next_page_index monotonically across sequential pages', () => { + const p0 = buildSearchResponse( + { results: new Array(10).fill({}), count: 50 }, + 0, + 10, + ); + const p1 = buildSearchResponse( + { results: new Array(10).fill({}), count: 50 }, + 1, + 10, + ); + const p2 = buildSearchResponse( + { results: new Array(10).fill({}), count: 50 }, + 2, + 10, + ); + + expect(p0['next_page_index']).toBe(1); + expect(p1['next_page_index']).toBe(2); + expect(p2['next_page_index']).toBe(3); + // The three pages must be distinguishable by their page_index echoes. + expect( + new Set([p0['page_index'], p1['page_index'], p2['page_index']]).size, + ).toBe(3); + }); +}); + describe('buildExportPayload', () => { it('builds bounded export payload with row cap and count request', () => { const payload = buildExportPayload('*'); diff --git a/tests/unit/tools-v11.test.ts b/tests/unit/tools-v11.test.ts index 60951f8..d48f922 100644 --- a/tests/unit/tools-v11.test.ts +++ b/tests/unit/tools-v11.test.ts @@ -401,6 +401,87 @@ describe('Discovery event tools', () => { { element: 'timestamp', order: 'Desc' }, ]); }); + + // ------------------------------------------------------------------ + // Pagination regression suite. Mirrors the contract verified in + // tools.test.ts for the other three search tools. If this block + // diverges from that one, the 4 tools stopped behaving identically. + // ------------------------------------------------------------------ + describe('pagination contract', () => { + it('sends distinct 1-based pageIndex for each page_index walked', async () => { + mockClient.post + .mockResolvedValueOnce({ results: [{ _id: 'a' }], count: 400 }) + .mockResolvedValueOnce({ results: [{ _id: 'b' }], count: 400 }) + .mockResolvedValueOnce({ results: [{ _id: 'c' }], count: 400 }); + + for (const idx of [0, 1, 2]) { + await client.callTool({ + name: 'search_discovery_events', + arguments: { + query: '*', + page_index: idx, + page_size: 100, + sorted_by: 'timestamp:Desc', + }, + }); + } + + const sent = mockClient.post.mock.calls + .slice(-3) + .map((c) => (c[1] as Record)['pageIndex']); + expect(sent).toEqual([1, 2, 3]); + }); + + it('returns the standardized envelope', async () => { + mockClient.post.mockResolvedValueOnce({ + results: Array.from({ length: 50 }, (_, i) => ({ _id: `r${i}` })), + count: 187, + }); + + const result = await client.callTool({ + name: 'search_discovery_events', + arguments: { query: '*', page_index: 0, page_size: 50 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['page_index']).toBe(0); + expect(parsed['page_size']).toBe(50); + expect(parsed['total']).toBe(187); + expect(parsed['has_more']).toBe(true); + expect(parsed['next_page_index']).toBe(1); + expect(parsed).not.toHaveProperty('pageIndex'); + expect(parsed).not.toHaveProperty('hasMore'); + }); + + it('next_page_index is null on last page', async () => { + mockClient.post.mockResolvedValueOnce({ + results: [{ _id: 'tail' }], + count: 1, + }); + + const result = await client.callTool({ + name: 'search_discovery_events', + arguments: { query: '*', page_index: 0, page_size: 100 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['has_more']).toBe(false); + expect(parsed['next_page_index']).toBeNull(); + }); + + it('defaults with_count=true', async () => { + mockClient.post.mockResolvedValueOnce({ results: [], count: 0 }); + await client.callTool({ + name: 'search_discovery_events', + arguments: { query: '*' }, + }); + const payload = mockClient.post.mock.calls[0]![1] as Record< + string, + unknown + >; + expect(payload['withCount']).toBe(true); + }); + }); }); describe('get_discovery_event', () => { diff --git a/tests/unit/tools.test.ts b/tests/unit/tools.test.ts index eb53187..fe1702e 100644 --- a/tests/unit/tools.test.ts +++ b/tests/unit/tools.test.ts @@ -194,7 +194,11 @@ describe('Lifecycle tools', () => { expect(payload['pageSize']).toBe(25); expect((parsed['results'] as unknown[]).length).toBe(1); - expect(parsed['pageIndex']).toBe(0); + expect(parsed['page_index']).toBe(0); + expect(parsed['page_size']).toBe(25); + // has_more/next_page_index are always present (deterministic contract) + expect(parsed).toHaveProperty('has_more'); + expect(parsed).toHaveProperty('next_page_index'); }); it('custom fields override preset', async () => { @@ -227,7 +231,134 @@ describe('Lifecycle tools', () => { unknown >; expect(payload['pageSize']).toBe(100); - expect(parsed['pageSize']).toBe(100); + expect(parsed['page_size']).toBe(100); + }); + + // -------------------------------------------------------------------- + // Pagination regression suite + // + // These tests guard against the "pagination returned the same page" + // class of bugs. Every paginated search tool must: + // 1. Send a strictly different pageIndex to the API for each + // page_index value the model passes in. + // 2. Return a deterministic envelope including has_more and + // next_page_index so the model never has to derive pagination + // state itself. + // 3. Default with_count=true so total is always populated when + // available from the API. + // If any of these invariants break, a real Horizon API (or a broken + // MCP shim) can silently return the same data twice -- the exact + // failure mode reported by users. + // -------------------------------------------------------------------- + describe('pagination contract', () => { + it('page_index increments reach the API as distinct 1-based pageIndex values', async () => { + // Model simulates walking three pages. Each call must hit the + // Horizon API with a distinct pageIndex (1, 2, 3) so we can never + // regress to serving the same page twice. + mockClient.post + .mockResolvedValueOnce({ results: [{ _id: 'a' }], count: 250 }) + .mockResolvedValueOnce({ results: [{ _id: 'b' }], count: 250 }) + .mockResolvedValueOnce({ results: [{ _id: 'c' }], count: 250 }); + + for (const idx of [0, 1, 2]) { + await client.callTool({ + name: 'search_certificates', + arguments: { + query: '*', + page_index: idx, + page_size: 100, + sorted_by: 'notAfter:Desc', + }, + }); + } + + const sentIndices = mockClient.post.mock.calls.map( + (c) => (c[1] as Record)['pageIndex'], + ); + expect(sentIndices).toEqual([1, 2, 3]); + }); + + it('echoes page_index as the 0-based value the caller provided', async () => { + mockClient.post.mockResolvedValueOnce({ + results: [{ _id: 'x' }], + count: 300, + }); + + const result = await client.callTool({ + name: 'search_certificates', + arguments: { query: '*', page_index: 2, page_size: 50 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['page_index']).toBe(2); + }); + + it('has_more=true and next_page_index set mid-pagination (with total)', async () => { + mockClient.post.mockResolvedValueOnce({ + results: Array.from({ length: 100 }, (_, i) => ({ _id: `r${i}` })), + count: 187, + }); + + const result = await client.callTool({ + name: 'search_certificates', + arguments: { query: '*', page_index: 0, page_size: 100 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['total']).toBe(187); + expect(parsed['has_more']).toBe(true); + expect(parsed['next_page_index']).toBe(1); + }); + + it('has_more=false and next_page_index=null on the last page', async () => { + // page_index=1 with page_size=100 on a total of 187 means this + // page returns the trailing 87, and there are no more pages. + mockClient.post.mockResolvedValueOnce({ + results: Array.from({ length: 87 }, (_, i) => ({ _id: `r${i}` })), + count: 187, + }); + + const result = await client.callTool({ + name: 'search_certificates', + arguments: { query: '*', page_index: 1, page_size: 100 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['total']).toBe(187); + expect(parsed['has_more']).toBe(false); + expect(parsed['next_page_index']).toBeNull(); + }); + + it('falls back to records.length heuristic when count is absent', async () => { + // No count -> cannot compare against total. has_more must still + // be deterministic by falling back to page fullness. + mockClient.post.mockResolvedValueOnce({ + results: Array.from({ length: 25 }, (_, i) => ({ _id: `r${i}` })), + }); + + const result = await client.callTool({ + name: 'search_certificates', + arguments: { query: '*', page_index: 0, page_size: 25 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['total']).toBeNull(); + // Page was full (25/25) -> another page may exist + expect(parsed['has_more']).toBe(true); + }); + + it('defaults with_count to true', async () => { + mockClient.post.mockResolvedValueOnce({ results: [] }); + await client.callTool({ + name: 'search_certificates', + arguments: { query: '*' }, + }); + const payload = mockClient.post.mock.calls[0]![1] as Record< + string, + unknown + >; + expect(payload['withCount']).toBe(true); + }); }); }); @@ -565,6 +696,154 @@ describe('Lifecycle tools', () => { expect(mockClient.post).not.toHaveBeenCalled(); }); }); + + // ========================================================================== + // Cross-tool pagination contract + // + // The CTO reported "pagination returned the same page" on a real-world + // Horizon instance. Every paginated search tool must behave identically so + // a fix (or regression) in one tool is provably reflected in all of them. + // This parametrised block asserts the contract per-tool without relying + // on domain-specific field shapes. + // ========================================================================== + describe.each([ + { + name: 'search_certificates', + endpoint: '/api/v1/certificates/search', + args: { query: 'status is valid' }, + }, + { + name: 'search_requests', + endpoint: '/api/v1/requests/search', + args: { query: 'status equals "pending"' }, + }, + { + name: 'search_events', + endpoint: '/api/v1/events/search', + args: { query: 'timestamp after -7d' }, + }, + ])('$name pagination contract', ({ name, endpoint, args }) => { + it('sends distinct 1-based pageIndex for each page_index walked', async () => { + mockClient.post + .mockResolvedValueOnce({ results: [{ _id: 'a' }], count: 500 }) + .mockResolvedValueOnce({ results: [{ _id: 'b' }], count: 500 }) + .mockResolvedValueOnce({ results: [{ _id: 'c' }], count: 500 }); + + for (const idx of [0, 1, 2]) { + await client.callTool({ + name, + arguments: { ...args, page_index: idx, page_size: 100 }, + }); + } + + const calls = mockClient.post.mock.calls.filter((c) => c[0] === endpoint); + expect(calls.length).toBeGreaterThanOrEqual(3); + const sent = calls + .slice(-3) + .map((c) => (c[1] as Record)['pageIndex']); + expect(sent).toEqual([1, 2, 3]); + }); + + it('returns a standardized pagination envelope', async () => { + mockClient.post.mockResolvedValueOnce({ + results: Array.from({ length: 50 }, (_, i) => ({ _id: `r${i}` })), + count: 250, + }); + + const result = await client.callTool({ + name, + arguments: { ...args, page_index: 0, page_size: 50 }, + }); + const parsed = parseToolResult(result); + + expect(parsed).toHaveProperty('results'); + expect(parsed['page_index']).toBe(0); + expect(parsed['page_size']).toBe(50); + expect(parsed['total']).toBe(250); + expect(parsed['has_more']).toBe(true); + expect(parsed['next_page_index']).toBe(1); + // Legacy camelCase fields should NOT be present -- they confused + // models when echoed alongside snake_case inputs. + expect(parsed).not.toHaveProperty('pageIndex'); + expect(parsed).not.toHaveProperty('pageSize'); + expect(parsed).not.toHaveProperty('hasMore'); + }); + + it('next_page_index is null when has_more is false', async () => { + mockClient.post.mockResolvedValueOnce({ + results: [{ _id: 'tail' }], + count: 1, + }); + + const result = await client.callTool({ + name, + arguments: { ...args, page_index: 0, page_size: 100 }, + }); + const parsed = parseToolResult(result); + + expect(parsed['has_more']).toBe(false); + expect(parsed['next_page_index']).toBeNull(); + }); + + it('defaults with_count=true so total is requested', async () => { + mockClient.post.mockResolvedValueOnce({ results: [], count: 0 }); + await client.callTool({ name, arguments: args }); + const last = mockClient.post.mock.calls.at(-1)!; + const payload = last[1] as Record; + expect(payload['withCount']).toBe(true); + }); + }); + + // ========================================================================== + // Domain-specific truncation guard rails + // + // Cert/request searches truncate large fields and point the model at + // get_certificate for the full value. Event searches must NOT do this + // because (a) event payloads are the primary output, and (b) the hint + // would send the model to the wrong recovery tool (should be get_event, + // not get_certificate). + // ========================================================================== + describe('field truncation per tool family', () => { + const LARGE_STRING = 'a'.repeat(2000); // > MAX_STRING_LEN + + it('search_events passes large detail fields through untouched', async () => { + mockClient.post.mockResolvedValueOnce({ + results: [{ code: 'X', details: { blob: LARGE_STRING } }], + count: 1, + }); + + const result = await client.callTool({ + name: 'search_events', + arguments: { query: 'timestamp after -1h' }, + }); + const parsed = parseToolResult(result); + const row = (parsed['results'] as Record[])[0]!; + const details = row['details'] as Record; + + expect(details['blob']).toBe(LARGE_STRING); + // Explicit guard: the cert-specific hint must never appear in an + // event response. If someone re-enables truncation here the wrong + // recovery tool would be suggested. + expect(JSON.stringify(parsed)).not.toContain('get_certificate'); + }); + + it('search_certificates still truncates large fields', async () => { + mockClient.post.mockResolvedValueOnce({ + results: [{ dn: 'CN=test', rawPem: LARGE_STRING }], + count: 1, + }); + + const result = await client.callTool({ + name: 'search_certificates', + arguments: { query: '*' }, + }); + const parsed = parseToolResult(result); + const row = (parsed['results'] as Record[])[0]!; + + expect(row['rawPem']).not.toBe(LARGE_STRING); + expect(String(row['rawPem']).length).toBeLessThan(LARGE_STRING.length); + }); + }); }); // =========================================================================== diff --git a/tests/unit/truth.test.ts b/tests/unit/truth.test.ts index c6ea3bc..9544251 100644 --- a/tests/unit/truth.test.ts +++ b/tests/unit/truth.test.ts @@ -1,8 +1,14 @@ +import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; import { describe, expect, it } from 'vitest'; import { SOURCE_ONLY_ALLOWED_PATHS, + collectHorizonOperations, + collectOpenApiOperations, normalizeRoutePath, + resolveTruthInputs, verifyMcpRouteTruth, } from '../../scripts/lib/truth.js'; @@ -119,3 +125,73 @@ describe('verifyMcpRouteTruth', () => { expect(result.issues[0]?.type).toBe('method_mismatch'); }); }); + +describe('resolveTruthInputs', () => { + it('falls back to checked-in truth artifacts when external inputs are unavailable', () => { + const projectRoot = mkdtempSync(join(tmpdir(), 'horizon-truth-')); + const artifactDir = join(projectRoot, 'src/generated/docs'); + + mkdirSync(artifactDir, { recursive: true }); + writeFileSync( + join(artifactDir, 'horizon-routes.json'), + JSON.stringify({ + generatedAt: '2026-04-22T00:00:00.000Z', + sourceRoot: '../horizon', + routeCount: 1, + routes: [ + { + method: 'GET', + path: '/api/v1/certificates', + sourceFile: '../horizon/conf/api.certificate.routes', + }, + ], + }), + 'utf8', + ); + writeFileSync( + join(artifactDir, 'openapi-operations.json'), + JSON.stringify({ + generatedAt: '2026-04-22T00:00:00.000Z', + openApiPath: '../evertrust_horizon_openapi.json', + operationCount: 1, + operations: [ + { + method: 'GET', + path: '/api/v1/certificates', + sourceFile: '../evertrust_horizon_openapi.json', + }, + ], + }), + 'utf8', + ); + + try { + const inputs = resolveTruthInputs(projectRoot); + + expect(inputs.horizonRoot).toBe(join(artifactDir, 'horizon-routes.json')); + expect(inputs.openApiPath).toBe( + join(artifactDir, 'openapi-operations.json'), + ); + expect(collectHorizonOperations(inputs.horizonRoot, projectRoot)).toEqual( + [ + { + method: 'GET', + path: '/api/v1/certificates', + sourceFile: '../horizon/conf/api.certificate.routes', + }, + ], + ); + expect(collectOpenApiOperations(inputs.openApiPath, projectRoot)).toEqual( + [ + { + method: 'GET', + path: '/api/v1/certificates', + sourceFile: '../evertrust_horizon_openapi.json', + }, + ], + ); + } finally { + rmSync(projectRoot, { recursive: true, force: true }); + } + }); +}); diff --git a/tests/unit/workflows.test.ts b/tests/unit/workflows.test.ts new file mode 100644 index 0000000..cb41533 --- /dev/null +++ b/tests/unit/workflows.test.ts @@ -0,0 +1,17 @@ +import { readFileSync } from 'node:fs'; +import { describe, expect, it } from 'vitest'; + +describe('GitHub workflows', () => { + it('does not reference secrets directly in if expressions', () => { + const workflows = [ + '.github/workflows/ci.yml', + '.github/workflows/release.yml', + ]; + + for (const workflow of workflows) { + const content = readFileSync(workflow, 'utf8'); + + expect(content).not.toMatch(/if:\s*\$\{\{[^}\n]*secrets\./); + } + }); +}); From 7c748a3bb9a4239d3497a4869d6393f8ee058c60 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 16:54:53 +0200 Subject: [PATCH 2/9] chore: scaffold skills directory shared assets Add skills/_shared/{preflight-template, quality-checklist, tool-gap-signaling, host-primitives, mcp-probe-patterns, prerequisites-schema}.md as the host-neutral foundation reused by every setup skill. --- skills/_shared/host-primitives.md | 45 +++++++++++++++ skills/_shared/mcp-probe-patterns.md | 35 ++++++++++++ skills/_shared/preflight-template.md | 42 ++++++++++++++ skills/_shared/prerequisites-schema.md | 68 ++++++++++++++++++++++ skills/_shared/quality-checklist.md | 29 ++++++++++ skills/_shared/tool-gap-signaling.md | 79 ++++++++++++++++++++++++++ 6 files changed, 298 insertions(+) create mode 100644 skills/_shared/host-primitives.md create mode 100644 skills/_shared/mcp-probe-patterns.md create mode 100644 skills/_shared/preflight-template.md create mode 100644 skills/_shared/prerequisites-schema.md create mode 100644 skills/_shared/quality-checklist.md create mode 100644 skills/_shared/tool-gap-signaling.md diff --git a/skills/_shared/host-primitives.md b/skills/_shared/host-primitives.md new file mode 100644 index 0000000..ea8ece5 --- /dev/null +++ b/skills/_shared/host-primitives.md @@ -0,0 +1,45 @@ +# Host Primitives Mapping + +Setup skills are authored to be host-neutral. This mapping documents how each generic primitive used in `SKILL.md` is realized in Claude Code and in Codex. + +| Generic primitive | Claude Code realization | Codex realization | +|-------------------|--------------------------|-------------------| +| Question primitive | `AskUserQuestion` tool | `prompt_user` agent function (declared in `agents/openai.yaml`) | +| Tool call primitive | direct call to the registered MCP tool by name | call to the same MCP tool via the OpenAI tool-call interface | +| Confirmation prompt for mutating tools | print plain text `Proceed? (yes/no)` and read the next user message | print plain text `Proceed? (yes/no)` and read the next user message | +| File read primitive | `Read` tool | OpenAI agent file-read function | +| Resource read primitive | `ReadMcpResourceTool` | OpenAI agent MCP resource-read function | + +## Confirmation pattern (verbatim) + +When a mutating MCP tool is about to be called, the skill MUST print: + +``` +About to call mutating tool `` with arguments: + +```json + +``` + +Proceed? (yes/no) +``` + +If the user replies anything other than `yes` (case-insensitive, leading/trailing whitespace ignored), the skill MUST skip the call and ask whether to retry, edit the arguments, or abort. + +## Sensitive value handling (verbatim) + +Sensitive prerequisites (those marked `sensitive: true` in `prerequisites.yaml`) MUST never appear in skill-produced output. Use the placeholder `` in any printed argument summary or transcript. Example: + +``` +About to call mutating tool `create_rest_notification` with arguments: + +```json +{ + "name": "", + "credential": "", + "headers": {"Authorization": "Bearer "} +} +``` +``` + +Even if the actual call uses the resolved value, the printed summary always uses the placeholder. diff --git a/skills/_shared/mcp-probe-patterns.md b/skills/_shared/mcp-probe-patterns.md new file mode 100644 index 0000000..fd680e9 --- /dev/null +++ b/skills/_shared/mcp-probe-patterns.md @@ -0,0 +1,35 @@ +# MCP / Skill / Knowledge Probe Patterns + +Phase 1 of every setup skill probes the live session for complementary capabilities. The skill MUST run the regex matches below against the names of every tool currently exposed in the session and record hits in a `discoveredCapabilities` list. + +## Probe regexes (case-insensitive, JavaScript flavor) + +| Skill | Regex | +|-------|-------| +| setup-adcs | `^mcp__.*(microsoft\|adcs\|active.?directory\|windows.?server).*` | +| setup-intune | `^mcp__.*(microsoft\|graph\|entra\|azure\|m365\|intune).*` | +| setup-digicert | `^mcp__.*digicert.*` | +| setup-f5 | `^mcp__.*(f5\|icontrol\|bigip\|big.?ip).*` | + +## Pseudocode + +```ts +function probeCapabilities(skillRegex: RegExp, availableTools: string[]): string[] { + return availableTools.filter((toolName) => skillRegex.test(toolName)); +} +``` + +`availableTools` is the list provided by the host (Claude Code surfaces this via the system prompt and the deferred-tool index; Codex surfaces it via the agent runtime tool registry). + +## Hit / no-hit semantics + +- **Hit**: the skill MUST mention each matched tool by name to the user, ask whether to use it for the relevant phase, and only proceed once the user confirms. +- **No hit**: the skill falls back to the embedded knowledge plus UI walkthrough. It MUST NOT pretend a capability exists. + +## Skill-level skill probes (optional) + +When the skill registry is exposed to the host (Codex `list_skills`, Claude Code skill catalog), the skill MAY probe for adjacent skills with names matching `setup-*` or vendor-specific helpers. Hits are surfaced to the user as suggestions only; the skill MUST NOT delegate execution to a skill it has not been explicitly told to call. + +## Knowledge resource probes + +In addition to the MCP tool probe, every skill calls `ReadMcpResourceTool` for each `horizon://knowledge/*` URI in its inventory row during Phase 0.4. A failure to resolve a knowledge URI is treated as a hard preflight failure and stops the skill. diff --git a/skills/_shared/preflight-template.md b/skills/_shared/preflight-template.md new file mode 100644 index 0000000..1c3cdae --- /dev/null +++ b/skills/_shared/preflight-template.md @@ -0,0 +1,42 @@ +# Phase 0 - Preflight (MANDATORY) + +This phase is imported by every setup skill. Do not skip steps. Do not paraphrase the tool calls. + +## 0.1 Capture user identity and license + +Call the `whoami` tool. From the returned object capture: + +- `userId` (string) +- `teams` (string array) +- `licensedModules` (string array; from the `license.modules` field if present, otherwise from `get_license_info`) +- `horizonVersion` (string; from the `instance.version` field if present, otherwise unknown) + +If `whoami` returns an error, STOP. Tell the user that the preflight could not authenticate against the Horizon instance configured for the `horizon` MCP server, ask them to verify the `HORIZON_URL`, `HORIZON_API_ID`, `HORIZON_API_KEY` (or mTLS credentials) of the MCP server, then exit. Do not advance to Phase 1. + +## 0.2 Verify the licensed modules + +Each setup skill lists the Horizon modules it requires (for example, `webra` and `intune` for setup-intune). The skill MUST cross-check these against `licensedModules`. If any required module is missing from the license, STOP. Tell the user the exact module that is missing, point them at their account manager, and exit. Do not advance to Phase 1. + +## 0.3 Verify knowledge resource reachability + +For every `horizon://knowledge/` URI listed in the skill's "Knowledge resources reused" line, attempt `ReadMcpResourceTool({uri: "horizon://knowledge/"})`. If any URI fails to resolve, STOP. Report the failing URI to the user and ask whether the `horizon` MCP server is healthy. Do not advance to Phase 1. + +## 0.4 Record context for later phases + +Print a short summary the user can copy/paste: + +``` +Horizon: +User: +Teams: +Licensed modules: +Knowledge resources OK: / +``` + +Then advance to Phase 1. + +## Notes + +- Never call mutating tools in Phase 0. +- Never collect prerequisites in Phase 0; that happens in Phase 2 only. +- Phase 0 is read-only. The fail-closed semantics above are deliberate: if any check fails, Phases 1-6 cannot run safely on this instance. diff --git a/skills/_shared/prerequisites-schema.md b/skills/_shared/prerequisites-schema.md new file mode 100644 index 0000000..34b6278 --- /dev/null +++ b/skills/_shared/prerequisites-schema.md @@ -0,0 +1,68 @@ +# `prerequisites.yaml` Schema + +Every setup skill ships a `references/prerequisites.yaml` file that drives the Phase 2 hard gate. The schema is enforced by `scripts/verify-skills.ts`. + +## Top-level shape + +```yaml +schema_version: "1" +prerequisites: + - + - + ... +``` + +## Prerequisite entry fields + +| Field | Type | Required | Description | +|-------|------|----------|-------------| +| `key` | string | yes | Placeholder name used everywhere in the skill. Convention: SCREAMING_SNAKE_CASE. | +| `description` | string | yes | Plain-language description shown to the user in the question prompt. | +| `required` | boolean | yes | If `true`, the skill MUST refuse to advance to Phase 3 until the value is collected. | +| `sensitive` | boolean | yes | If `true`, the value is never printed in skill output, summaries, transcripts, or argument previews. | +| `default` | string \| number \| boolean \| null | no | Default value used when `required: false` and the user gives no value. | +| `validator` | string | no | A regular expression (POSIX ERE compatible) the value must match before the skill accepts it. | +| `enum` | array | no | If present, the value MUST be one of these values. Mutually exclusive with `validator`. | +| `applies_to` | array of strings | no | If present, the prerequisite is only collected when the skill's variant gate matches one of these tokens (for example `["intune"]` or `["intunepkcs"]`). Absent means "always". | +| `example` | string | no | A plausible-looking example used in question previews. | + +## Worked example (used by setup-adcs) + +```yaml +schema_version: "1" +prerequisites: + - key: ADCS_VARIANT + description: "Choose the ADCS connector variant: evtadcs (recommended, EverTrust ADCS Connector) or msadcs (legacy Microsoft ADCS Web)." + required: true + sensitive: false + enum: ["evtadcs", "msadcs"] + default: "evtadcs" + - key: ADCS_CONNECTOR_URL + description: "Base URL of the EverTrust ADCS Connector, including scheme and port." + required: true + sensitive: false + validator: "^https://[A-Za-z0-9.-]+:[0-9]+$" + example: "https://adcs01.corp.example.com:4443" + - key: ADCS_ENROLLMENT_AGENT_PASSPHRASE + description: "Passphrase protecting the Enrollment Agent PKCS#12." + required: true + sensitive: true + validator: ".{8,}" + - key: HORIZON_CRL_FALLBACK_POLICY + description: "Policy when the CRL Distribution Point is unreachable." + required: false + sensitive: false + enum: ["Last available status", "Strict"] + default: "Last available status" +``` + +## Validator semantics + +- `validator` regexes are anchored as written. Skills SHOULD use `^` and `$` explicitly. +- `enum` values are compared with strict string equality. +- A prerequisite with `required: true` and no `default` MUST be collected from the user; if the value fails `validator` or `enum`, the skill re-asks the same question. +- Sensitive prerequisites MUST NOT have their values printed in any skill output. The skill prints `` instead. + +## Schema version + +`schema_version` is `"1"` for v1 of these skills. Future versions of this schema MUST bump the field and update `scripts/verify-skills.ts`. diff --git a/skills/_shared/quality-checklist.md b/skills/_shared/quality-checklist.md new file mode 100644 index 0000000..64a4904 --- /dev/null +++ b/skills/_shared/quality-checklist.md @@ -0,0 +1,29 @@ +# Production-Grade Quality Checklist + +Every setup skill is verified against EVERY item below before being considered complete. This checklist also gates future setup skills added to this directory. + +1. SKILL.md frontmatter contains exactly these six keys: `name`, `description`, `when_to_use`, `version`, `requires_mcp`, `tags`. All values are populated. No additional keys. +2. SKILL.md is under 800 lines. +3. SKILL.md links to `references/recipe.md`, `references/prerequisites.yaml`, `references/troubleshooting.md`. Each file exists at the canonical path. +4. `agents/openai.yaml` exists, valid YAML, schema = `openai-skill-agent/v1`. References `./SKILL.md`, `./references/recipe.md`, `./references/prerequisites.yaml`, `./references/troubleshooting.md`. The `model` field is hard-set, never deferred. +5. `references/recipe.md` exists, contains all 8 sections in this exact order: top heading, `## Architecture summary`, `## External system prerequisites`, `## Horizon prerequisites`, `## External system setup steps`, `## Horizon setup steps`, `## Verification`, `## Common failure points`. No private Outline URLs. +6. `references/prerequisites.yaml` exists and validates against `_shared/prerequisites-schema.md`. Every entry has `key`, `description`, `required`, `sensitive`. Optional entries also have `default`. `validator` is provided wherever applicable. +7. `references/troubleshooting.md` exists, three-column table: `Problem | Possible Cause | Solution`. +8. Phase 0 calls `whoami`, `get_license_info`, and `ReadMcpResourceTool` for every `horizon://knowledge/*` URI listed in the skill's row of the inventory table. +9. Phase 1 contains the regex probes from `_shared/mcp-probe-patterns.md` and records `discoveredCapabilities`. +10. Phase 2 asks every `required: true` prerequisite via `AskUserQuestion` (or the host equivalent). The skill body explicitly refuses to advance until every required value is captured. +11. Phase 4 verifies every Horizon write action with the corresponding existing read tool (`list_credentials`, `list_profiles`, `get_profile`, `list_triggers`, `list_datasources`, `list_dashboards`, `search_certificates`, `search_events`, `search_discovery_events`). +12. Every variant choice (for example `evtadcs` vs `msadcs`, `intune` vs `intunepkcs`, `f5client` vs `f5as3`, `US` vs `EU`) is gated by an explicit `AskUserQuestion`. +13. Every immutable name prerequisite collects both `` and ``, per the Horizon API rule that names are primary keys. +14. Connector type, trigger type, third-party connector type, and module strings used in the skill match `src/models/enums.ts` byte-for-byte. No fabrication. +15. The skill ends with a "Missing MCP Tools" section that is a strict subset of `_shared/tool-gap-signaling.md`. +16. No em-dashes anywhere in the skill files. Use a regular hyphen or rephrase the sentence. +17. Every HCQL/HRQL/HEQL/HDQL/HPQL example uses lowercase field names. The skill explicitly mentions the lowercase rule near its first query example. +18. Idempotent: every write step first runs the matching `list_*` or `get_*` to detect existing objects and offers `reuse / rename / abort`. +19. Every mutating MCP tool call (annotated `Safety tier: mutating` in its source description; `simulate_trigger` is read-only and exempt) is preceded by a printed confirmation showing tool name, arguments, and `Proceed? (yes/no)`. +20. The skill makes NO references to "as you saw earlier" or other inter-step memory. Each phase is independently re-readable by a small model. +21. The skill's `description` field includes the `setup:` colon-form trigger phrase even though the folder cannot. +22. The skill content has no remote URLs except: (a) `horizon://knowledge/*`, (b) public vendor docs (Microsoft Learn, DigiCert dev docs glossary, F5 iControl REST docs). +23. The skill never references `evertrust.getoutline.com`. +24. `manifest.json` includes the skill with the exact `id`, `description`, `tags`, `requires_mcp`, `version` from the inventory table. +25. The skill is added to the `skills/README.md` index. Sensitive prerequisites (`sensitive: true`) are not echoed in any skill output, summary, or transcript. diff --git a/skills/_shared/tool-gap-signaling.md b/skills/_shared/tool-gap-signaling.md new file mode 100644 index 0000000..657905c --- /dev/null +++ b/skills/_shared/tool-gap-signaling.md @@ -0,0 +1,79 @@ +# Missing MCP Tools - Master Union List + +Every setup skill ends with a "Missing MCP Tools" section that is a strict subset of this list. New skills MUST extend this file rather than restate gaps inline. + +## Format used by each skill + +``` +- : +``` + +## Master union list + +### Credentials + +- `create_credential`: create a Horizon credential of type `login`, `certificate-pkcs12`, `api-token`, or `raw` and assign its target (PKI Connectors, third-party connectors, MDM, SCEP RA). +- `update_credential`: update an existing credential (rotate password, replace PKCS#12). +- `delete_credential`: delete a credential by name. + +### PKI connectors + +- `list_pki_connectors`: enumerate all PKI connectors with their type and current status. +- `get_pki_connector`: fetch a PKI connector by name with full configuration. +- `create_pki_connector`: create a PKI connector for any of the 19 connector types in `src/models/enums.ts`. +- `update_pki_connector`: edit the configuration of an existing PKI connector. +- `delete_pki_connector`: delete a PKI connector by name. + +### Third-party connectors + +- `list_third_party_connectors`: enumerate all third-party connectors. +- `get_third_party_connector`: fetch a third-party connector by name. +- `create_third_party_connector`: create a third-party connector for any of the 10 third-party connector types. +- `update_third_party_connector`: edit the configuration of an existing third-party connector. +- `delete_third_party_connector`: delete a third-party connector by name. + +### Profiles + +- `create_profile`: create a Horizon profile for any of the 11 module types. +- `update_profile`: edit an existing profile (bind connector, attach trigger, edit policies). +- `delete_profile`: delete a profile by name. + +### Certification authorities + +- `list_certification_authorities`: enumerate trusted CAs in Horizon. +- `get_certification_authority`: fetch a CA by name with its trust settings. +- `create_certification_authority`: import a trusted CA with CRL URL and trust flags. +- `update_certification_authority`: edit trust flags or CRL fallback policy. +- `delete_certification_authority`: delete a CA by name. +- `import_certificate_chain`: import a multi-cert chain (root + intermediates) in one call. + +### Triggers + +- `create_email_trigger`: create an email-notification trigger. +- `create_f5client_trigger`: create an F5 iControl REST lifecycle trigger. +- `create_f5as3_trigger`: create an F5 AS3 declarative lifecycle trigger. +- `create_intunepkcs_trigger`: create an Intune PKCS lifecycle trigger. +- `create_akv_trigger`: create an Azure Key Vault lifecycle trigger. +- `create_aws_trigger`: create an AWS ACM lifecycle trigger. +- `create_gcm_trigger`: create a Google Certificate Manager lifecycle trigger. +- `create_webhook_trigger`: create a generic webhook trigger. +- `update_trigger`: edit an existing trigger. +- `attach_trigger_to_profile`: bind a trigger to a profile via `triggerHooks` without going through the UI. + +### Scheduled tasks + +- `list_scheduled_tasks`: enumerate WebRA scheduled tasks. +- `get_scheduled_task`: fetch a scheduled task by name. +- `create_scheduled_task`: create a WebRA scheduled task with cron expression and target operation. +- `update_scheduled_task`: edit cron, scope, or operation of an existing scheduled task. +- `delete_scheduled_task`: delete a scheduled task by name. + +### Discovery datasources beyond DNS / LDAP / REST + +- `create_f5_datasource`: create an F5 BIG-IP datasource for `create_discovery_campaign`. +- `create_aws_datasource`: create an AWS ACM / IAM datasource. +- `create_akv_datasource`: create an Azure Key Vault datasource. +- `create_digicert_datasource`: create a DigiCert datasource. +- `create_globalsign_datasource`: create a GlobalSign datasource. +- `create_hashicorp_vault_datasource`: create a HashiCorp Vault datasource. +- `discovery_source_type`: extension to `create_discovery_campaign` so that F5, cloud, and vault sources can be wired without `horizon-cli`. From 7d343c91171e7494b80f3170731fb109618c60c9 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 16:55:56 +0200 Subject: [PATCH 3/9] chore: add skills manifest and README Add skills/manifest.json (plugin manifest with one entry per skill) and skills/README.md (index, invocation guidance for Claude Code and Codex, relationship to .claude/skills/, and authoring instructions). --- skills/README.md | 81 ++++++++++++++++++++++++++++++++++++++++ skills/manifest.json | 89 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 170 insertions(+) create mode 100644 skills/README.md create mode 100644 skills/manifest.json diff --git a/skills/README.md b/skills/README.md new file mode 100644 index 0000000..fcadf39 --- /dev/null +++ b/skills/README.md @@ -0,0 +1,81 @@ +# Horizon Setup Skills + +Production-grade setup recipes that walk a user end-to-end through integrating Evertrust Horizon CLM with a third-party system. Each skill is a deterministic, plug-and-play walkthrough designed to be safe for less capable models (Claude Sonnet/Haiku, GPT mini/nano). + +These skills ship from this repository and are designed to be packaged later as a plugin for both Claude Code and Codex. + +## What lives here + +- `skills/setup-adcs/` - Microsoft ADCS connector setup (`evtadcs` and `msadcs` variants). +- `skills/setup-intune/` - Microsoft Intune integration (`intune` SCEP and `intunepkcs` variants). +- `skills/setup-digicert/` - DigiCert CertCentral connector setup (US and EU regions). +- `skills/setup-f5/` - F5 BIG-IP technical user provisioning, lifecycle automation, and discovery. + +Every skill is a five-file bundle: + +``` +skills// + SKILL.md # main entrypoint with frontmatter and 7 phases + agents/openai.yaml # Codex agent file (Claude Code ignores this) + references/recipe.md # full recipe content for offline reading + references/prerequisites.yaml # machine-readable prerequisites (drives Phase 2) + references/troubleshooting.md # symptom / cause / fix table +``` + +Shared scaffolding lives under `skills/_shared/` and is imported by reference from every skill: + +- `preflight-template.md` - Phase 0 boilerplate. +- `quality-checklist.md` - 25 items that every skill is verified against. +- `tool-gap-signaling.md` - master union list of missing MCP tools. +- `host-primitives.md` - Claude vs Codex primitive mapping. +- `mcp-probe-patterns.md` - probe regexes for complementary MCPs. +- `prerequisites-schema.md` - YAML schema for `references/prerequisites.yaml`. + +## How to invoke + +### Claude Code + +Type the slash form of any trigger phrase, for example `/setup-adcs`, `/setup-intune`, `/setup-digicert`, `/setup-f5`. The skill is invoked via the `Skill` tool. Frontmatter `description` and `tags` carry the trigger phrase synonyms. + +### Codex + +Use the colon form, for example `setup:adcs`, `setup:intune`, `setup:digicert`, `setup:f5`. The agent definition lives in `/agents/openai.yaml` and points at `SKILL.md` as the system prompt. + +### Generic instruction + +If your host does not understand either form, ask the model to "set up " or "configure on Horizon" and the skill description matches that natural language too. + +## Relationship to `.claude/skills/` + +The pre-existing `.claude/skills/*` tree (for example `add-tool.md`, `gitnexus/*`) holds Claude-Code-only authoring helpers used by repository contributors. It is intentionally kept separate from `skills/` because: + +- `.claude/skills/` targets developers editing this repo. +- `skills/` targets end users running an integration walkthrough against their Horizon instance. + +Both trees are kept; do not merge them. + +## Running the verification suite + +```bash +bun run verify:skills # frontmatter, YAML schema, recipe headings, manifest, allowlist +bun run lint:skills # YAML and Markdown lint +``` + +`bun run validate:ci` runs both alongside the existing CI checks. + +## Production-grade quality checklist + +Every skill is verified against `_shared/quality-checklist.md` before being merged. New skills MUST tick every box. + +## Plugin packaging + +`manifest.json` enumerates every skill with the metadata required by the future Claude / Codex plugin packagers. To override the OpenAI agent model used by Codex at install time, the packager reads the `--model=` flag and rewrites every `agents/openai.yaml` in place. + +## Authoring a new setup skill + +1. Add a folder `skills/setup-/` with the canonical five-file layout. +2. Append a corresponding `tags` row in `_shared/mcp-probe-patterns.md`. +3. Append a manifest entry in `manifest.json`. +4. Append a row in this README's "What lives here" list. +5. Tick every item in `_shared/quality-checklist.md` before opening the PR. +6. Run `bun run verify:skills && bun run lint:skills`. diff --git a/skills/manifest.json b/skills/manifest.json new file mode 100644 index 0000000..542dfd3 --- /dev/null +++ b/skills/manifest.json @@ -0,0 +1,89 @@ +{ + "schema_version": "1", + "skills": [ + { + "id": "setup-adcs", + "name": "Microsoft ADCS setup", + "description": "Walks the user through end-to-end setup of a Microsoft ADCS integration on a live Horizon CLM instance, asking for every prerequisite up front and verifying state at every step using the horizon MCP tools. Triggers: setup:adcs, /setup-adcs.", + "entrypoint": "skills/setup-adcs/SKILL.md", + "agent_files": ["skills/setup-adcs/agents/openai.yaml"], + "references": [ + "skills/setup-adcs/references/recipe.md", + "skills/setup-adcs/references/prerequisites.yaml", + "skills/setup-adcs/references/troubleshooting.md" + ], + "tags": [ + "setup:adcs", + "/setup-adcs", + "set up ADCS", + "configure ADCS connector", + "Microsoft ADCS integration" + ], + "requires_mcp": ["horizon"], + "version": "0.1.0" + }, + { + "id": "setup-intune", + "name": "Microsoft Intune setup", + "description": "Walks the user through end-to-end setup of a Microsoft Intune integration on a live Horizon CLM instance covering both intune (SCEP) and intunepkcs variants, asking for every prerequisite up front and verifying state at every step. Triggers: setup:intune, /setup-intune.", + "entrypoint": "skills/setup-intune/SKILL.md", + "agent_files": ["skills/setup-intune/agents/openai.yaml"], + "references": [ + "skills/setup-intune/references/recipe.md", + "skills/setup-intune/references/prerequisites.yaml", + "skills/setup-intune/references/troubleshooting.md" + ], + "tags": [ + "setup:intune", + "/setup-intune", + "set up Intune", + "configure Intune SCEP", + "configure Intune PKCS", + "MDM Intune" + ], + "requires_mcp": ["horizon"], + "version": "0.1.0" + }, + { + "id": "setup-digicert", + "name": "DigiCert CertCentral setup", + "description": "Walks the user through end-to-end setup of a DigiCert CertCentral integration on a live Horizon CLM instance, asking for every prerequisite up front and verifying state at every step. Triggers: setup:digicert, /setup-digicert.", + "entrypoint": "skills/setup-digicert/SKILL.md", + "agent_files": ["skills/setup-digicert/agents/openai.yaml"], + "references": [ + "skills/setup-digicert/references/recipe.md", + "skills/setup-digicert/references/prerequisites.yaml", + "skills/setup-digicert/references/troubleshooting.md" + ], + "tags": [ + "setup:digicert", + "/setup-digicert", + "set up DigiCert", + "configure DigiCert CertCentral" + ], + "requires_mcp": ["horizon"], + "version": "0.1.0" + }, + { + "id": "setup-f5", + "name": "F5 BIG-IP setup", + "description": "Walks the user through end-to-end setup of an F5 BIG-IP integration on a live Horizon CLM instance covering iControl REST role provisioning, lifecycle automation triggers, scheduled tasks, and discovery, asking for every prerequisite up front. Triggers: setup:f5, /setup-f5.", + "entrypoint": "skills/setup-f5/SKILL.md", + "agent_files": ["skills/setup-f5/agents/openai.yaml"], + "references": [ + "skills/setup-f5/references/recipe.md", + "skills/setup-f5/references/prerequisites.yaml", + "skills/setup-f5/references/troubleshooting.md" + ], + "tags": [ + "setup:f5", + "/setup-f5", + "set up F5", + "configure F5 BIG-IP", + "F5 lifecycle automation" + ], + "requires_mcp": ["horizon"], + "version": "0.1.0" + } + ] +} From b3335a50279940101b7714099da74c2de47443c6 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 16:59:53 +0200 Subject: [PATCH 4/9] chore: add verify-skills script and tests Add scripts/verify-skills.ts (frontmatter, agents/openai.yaml, recipe headings, prerequisites schema, manifest consistency, em-dash and Outline URL bans, tool allowlist enforcement), tests/unit/skills.test.ts, and .markdownlint-cli2.jsonc. Update package.json: include skills/ in publish files, add verify:skills and lint:skills scripts, add yaml and markdownlint-cli2 devDependencies, wire both into validate:ci. --- .markdownlint-cli2.jsonc | 11 + bun.lock | 146 +++++++++- package.json | 11 +- scripts/verify-skills.ts | 549 ++++++++++++++++++++++++++++++++++++++ tests/unit/skills.test.ts | 172 ++++++++++++ 5 files changed, 884 insertions(+), 5 deletions(-) create mode 100644 .markdownlint-cli2.jsonc create mode 100644 scripts/verify-skills.ts create mode 100644 tests/unit/skills.test.ts diff --git a/.markdownlint-cli2.jsonc b/.markdownlint-cli2.jsonc new file mode 100644 index 0000000..6801cca --- /dev/null +++ b/.markdownlint-cli2.jsonc @@ -0,0 +1,11 @@ +{ + "config": { + "default": true, + "MD013": false, + "MD024": { "siblings_only": true }, + "MD033": false, + "MD041": false, + "MD046": false + }, + "ignores": ["node_modules/**", "dist/**", ".gitnexus/**"] +} diff --git a/bun.lock b/bun.lock index ac64e05..ca8a2b4 100644 --- a/bun.lock +++ b/bun.lock @@ -24,6 +24,7 @@ "globals": "17.4.0", "husky": "9.1.7", "lint-staged": "16.4.0", + "markdownlint-cli2": "0.18.1", "prettier": "3.8.1", "semantic-release": "^25.0.3", "tsup": "8.5.1", @@ -31,6 +32,7 @@ "typescript": "6.0.2", "typescript-eslint": "8.58.0", "vitest": "4.1.2", + "yaml": "2.7.0", }, "optionalDependencies": { "playwright": "1.59.1", @@ -190,6 +192,12 @@ "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1", "zod": "^3.25 || ^4.0" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="], + "@nodelib/fs.scandir": ["@nodelib/fs.scandir@2.1.5", "", { "dependencies": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" } }, "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g=="], + + "@nodelib/fs.stat": ["@nodelib/fs.stat@2.0.5", "", {}, "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A=="], + + "@nodelib/fs.walk": ["@nodelib/fs.walk@1.2.8", "", { "dependencies": { "@nodelib/fs.scandir": "2.1.5", "fastq": "^1.6.0" } }, "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg=="], + "@octokit/auth-token": ["@octokit/auth-token@6.0.0", "", {}, "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="], "@octokit/core": ["@octokit/core@7.0.6", "", { "dependencies": { "@octokit/auth-token": "^6.0.0", "@octokit/graphql": "^9.0.3", "@octokit/request": "^10.0.6", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q=="], @@ -298,6 +306,8 @@ "@types/chai": ["@types/chai@5.2.3", "", { "dependencies": { "@types/deep-eql": "*", "assertion-error": "^2.0.1" } }, "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA=="], + "@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="], + "@types/deep-eql": ["@types/deep-eql@4.0.2", "", {}, "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw=="], "@types/esrecurse": ["@types/esrecurse@4.3.1", "", {}, "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw=="], @@ -306,10 +316,16 @@ "@types/json-schema": ["@types/json-schema@7.0.15", "", {}, "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA=="], + "@types/katex": ["@types/katex@0.16.8", "", {}, "sha512-trgaNyfU+Xh2Tc+ABIb44a5AYUpicB3uwirOioeOkNPPbmgRNtcWyDeeFRzjPZENO9Vq8gvVqfhaaXWLlevVwg=="], + + "@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="], + "@types/node": ["@types/node@25.5.2", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-tO4ZIRKNC+MDWV4qKVZe3Ql/woTnmHDr5JD8UI5hn2pwBrHEwOEMZK7WlNb5RKB6EoJ02gwmQS9OrjuFnZYdpg=="], "@types/normalize-package-data": ["@types/normalize-package-data@2.4.4", "", {}, "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="], + "@types/unist": ["@types/unist@2.0.11", "", {}, "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="], + "@typescript-eslint/eslint-plugin": ["@typescript-eslint/eslint-plugin@8.58.0", "", { "dependencies": { "@eslint-community/regexpp": "^4.12.2", "@typescript-eslint/scope-manager": "8.58.0", "@typescript-eslint/type-utils": "8.58.0", "@typescript-eslint/utils": "8.58.0", "@typescript-eslint/visitor-keys": "8.58.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" }, "peerDependencies": { "@typescript-eslint/parser": "^8.58.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-RLkVSiNuUP1C2ROIWfqX+YcUfLaSnxGE/8M+Y57lopVwg9VTYYfhuz15Yf1IzCKgZj6/rIbYTmJCUSqr76r0Wg=="], "@typescript-eslint/parser": ["@typescript-eslint/parser@8.58.0", "", { "dependencies": { "@typescript-eslint/scope-manager": "8.58.0", "@typescript-eslint/types": "8.58.0", "@typescript-eslint/typescript-estree": "8.58.0", "@typescript-eslint/visitor-keys": "8.58.0", "debug": "^4.4.3" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-rLoGZIf9afaRBYsPUMtvkDWykwXwUPL60HebR4JgTI8mxfFe2cQTu3AGitANp4b9B2QlVru6WzjgB2IzJKiCSA=="], @@ -404,6 +420,12 @@ "char-regex": ["char-regex@1.0.2", "", {}, "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw=="], + "character-entities": ["character-entities@2.0.2", "", {}, "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ=="], + + "character-entities-legacy": ["character-entities-legacy@3.0.0", "", {}, "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ=="], + + "character-reference-invalid": ["character-reference-invalid@2.0.1", "", {}, "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw=="], + "chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="], "clean-stack": ["clean-stack@2.2.0", "", {}, "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A=="], @@ -470,12 +492,18 @@ "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="], + "decode-named-character-reference": ["decode-named-character-reference@1.3.0", "", { "dependencies": { "character-entities": "^2.0.0" } }, "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q=="], + "deep-extend": ["deep-extend@0.6.0", "", {}, "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA=="], "deep-is": ["deep-is@0.1.4", "", {}, "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ=="], "depd": ["depd@2.0.0", "", {}, "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw=="], + "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="], + + "devlop": ["devlop@1.1.0", "", { "dependencies": { "dequal": "^2.0.0" } }, "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA=="], + "dir-glob": ["dir-glob@3.0.1", "", { "dependencies": { "path-type": "^4.0.0" } }, "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA=="], "dot-prop": ["dot-prop@5.3.0", "", { "dependencies": { "is-obj": "^2.0.0" } }, "sha512-QM8q3zDe58hqUqjraQOmzZ1LIH9SWQJTlEKCH4kJ2oQvLZk7RbQXvtDM2XEq3fwkV9CCvvH4LA0AV+ogFsBM2Q=="], @@ -492,6 +520,8 @@ "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="], + "entities": ["entities@4.5.0", "", {}, "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw=="], + "env-ci": ["env-ci@11.2.0", "", { "dependencies": { "execa": "^8.0.0", "java-properties": "^1.0.2" } }, "sha512-D5kWfzkmaOQDioPmiviWAVtKmpPT4/iJmMVQxWxMPJTFyTkdc5JQUfc5iXEeWxcOdsYTKSAiA/Age4NUOqKsRA=="], "env-paths": ["env-paths@2.2.1", "", {}, "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A=="], @@ -556,12 +586,16 @@ "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="], + "fast-glob": ["fast-glob@3.3.3", "", { "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.2", "merge2": "^1.3.0", "micromatch": "^4.0.8" } }, "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg=="], + "fast-json-stable-stringify": ["fast-json-stable-stringify@2.1.0", "", {}, "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="], "fast-levenshtein": ["fast-levenshtein@2.0.6", "", {}, "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw=="], "fast-uri": ["fast-uri@3.1.0", "", {}, "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA=="], + "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="], + "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" } }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="], "figures": ["figures@6.1.0", "", { "dependencies": { "is-unicode-supported": "^2.0.0" } }, "sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg=="], @@ -620,6 +654,8 @@ "globals": ["globals@17.4.0", "", {}, "sha512-hjrNztw/VajQwOLsMNT1cbJiH2muO3OROCHnbehc8eY5JyD2gqz4AcMHPqgaOR59DjgUjYAYLeH699g/eWi2jw=="], + "globby": ["globby@14.1.0", "", { "dependencies": { "@sindresorhus/merge-streams": "^2.1.0", "fast-glob": "^3.3.3", "ignore": "^7.0.3", "path-type": "^6.0.0", "slash": "^5.1.0", "unicorn-magic": "^0.3.0" } }, "sha512-0Ia46fDOaT7k4og1PDW4YbodWWr3scS2vAr2lTbsplOt2WkKp0vQbkI9wKis/T5LV/dqPjO3bpS/z6GTJB82LA=="], + "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="], "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="], @@ -676,14 +712,22 @@ "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="], + "is-alphabetical": ["is-alphabetical@2.0.1", "", {}, "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ=="], + + "is-alphanumerical": ["is-alphanumerical@2.0.1", "", { "dependencies": { "is-alphabetical": "^2.0.0", "is-decimal": "^2.0.0" } }, "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw=="], + "is-arrayish": ["is-arrayish@0.2.1", "", {}, "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg=="], + "is-decimal": ["is-decimal@2.0.1", "", {}, "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A=="], + "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="], "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="], "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="], + "is-hexadecimal": ["is-hexadecimal@2.0.1", "", {}, "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg=="], + "is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="], "is-obj": ["is-obj@2.0.0", "", {}, "sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w=="], @@ -714,7 +758,7 @@ "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="], - "js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="], + "js-yaml": ["js-yaml@4.1.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA=="], "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="], @@ -732,8 +776,12 @@ "json-with-bigint": ["json-with-bigint@3.5.8", "", {}, "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw=="], + "jsonc-parser": ["jsonc-parser@3.3.1", "", {}, "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ=="], + "jsonfile": ["jsonfile@6.2.0", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg=="], + "katex": ["katex@0.16.45", "", { "dependencies": { "commander": "^8.3.0" }, "bin": { "katex": "cli.js" } }, "sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA=="], + "keyv": ["keyv@4.5.4", "", { "dependencies": { "json-buffer": "3.0.1" } }, "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw=="], "levn": ["levn@0.4.1", "", { "dependencies": { "prelude-ls": "^1.2.1", "type-check": "~0.4.0" } }, "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ=="], @@ -742,6 +790,8 @@ "lines-and-columns": ["lines-and-columns@1.2.4", "", {}, "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg=="], + "linkify-it": ["linkify-it@5.0.0", "", { "dependencies": { "uc.micro": "^2.0.0" } }, "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ=="], + "lint-staged": ["lint-staged@16.4.0", "", { "dependencies": { "commander": "^14.0.3", "listr2": "^9.0.5", "picomatch": "^4.0.3", "string-argv": "^0.3.2", "tinyexec": "^1.0.4", "yaml": "^2.8.2" }, "bin": { "lint-staged": "bin/lint-staged.js" } }, "sha512-lBWt8hujh/Cjysw5GYVmZpFHXDCgZzhrOm8vbcUdobADZNOK/bRshr2kM3DfgrrtR1DQhfupW9gnIXOfiFi+bw=="], "listr2": ["listr2@9.0.5", "", { "dependencies": { "cli-truncate": "^5.0.0", "colorette": "^2.0.20", "eventemitter3": "^5.0.1", "log-update": "^6.1.0", "rfdc": "^1.4.1", "wrap-ansi": "^9.0.0" } }, "sha512-ME4Fb83LgEgwNw96RKNvKV4VTLuXfoKudAmm2lP8Kk87KaMK0/Xrx/aAkMWmT8mDb+3MlFDspfbCs7adjRxA2g=="], @@ -786,12 +836,22 @@ "make-asynchronous": ["make-asynchronous@1.1.0", "", { "dependencies": { "p-event": "^6.0.0", "type-fest": "^4.6.0", "web-worker": "^1.5.0" } }, "sha512-ayF7iT+44LXdxJLTrTd3TLQpFDDvPCBxXxbv+pMUSuHA5Q8zyAfwkRP6aHHwNVFBUFWtxAHqwNJxF8vMZLAbVg=="], + "markdown-it": ["markdown-it@14.1.0", "", { "dependencies": { "argparse": "^2.0.1", "entities": "^4.4.0", "linkify-it": "^5.0.0", "mdurl": "^2.0.0", "punycode.js": "^2.3.1", "uc.micro": "^2.1.0" }, "bin": { "markdown-it": "bin/markdown-it.mjs" } }, "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg=="], + + "markdownlint": ["markdownlint@0.38.0", "", { "dependencies": { "micromark": "4.0.2", "micromark-core-commonmark": "2.0.3", "micromark-extension-directive": "4.0.0", "micromark-extension-gfm-autolink-literal": "2.1.0", "micromark-extension-gfm-footnote": "2.1.0", "micromark-extension-gfm-table": "2.1.1", "micromark-extension-math": "3.1.0", "micromark-util-types": "2.0.2" } }, "sha512-xaSxkaU7wY/0852zGApM8LdlIfGCW8ETZ0Rr62IQtAnUMlMuifsg09vWJcNYeL4f0anvr8Vo4ZQar8jGpV0btQ=="], + + "markdownlint-cli2": ["markdownlint-cli2@0.18.1", "", { "dependencies": { "globby": "14.1.0", "js-yaml": "4.1.0", "jsonc-parser": "3.3.1", "markdown-it": "14.1.0", "markdownlint": "0.38.0", "markdownlint-cli2-formatter-default": "0.0.5", "micromatch": "4.0.8" }, "bin": { "markdownlint-cli2": "markdownlint-cli2-bin.mjs" } }, "sha512-/4Osri9QFGCZOCTkfA8qJF+XGjKYERSHkXzxSyS1hd3ZERJGjvsUao2h4wdnvpHp6Tu2Jh/bPHM0FE9JJza6ng=="], + + "markdownlint-cli2-formatter-default": ["markdownlint-cli2-formatter-default@0.0.5", "", { "peerDependencies": { "markdownlint-cli2": ">=0.0.4" } }, "sha512-4XKTwQ5m1+Txo2kuQ3Jgpo/KmnG+X90dWt4acufg6HVGadTUG5hzHF/wssp9b5MBYOMCnZ9RMPaU//uHsszF8Q=="], + "marked": ["marked@15.0.12", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA=="], "marked-terminal": ["marked-terminal@7.3.0", "", { "dependencies": { "ansi-escapes": "^7.0.0", "ansi-regex": "^6.1.0", "chalk": "^5.4.1", "cli-highlight": "^2.1.11", "cli-table3": "^0.6.5", "node-emoji": "^2.2.0", "supports-hyperlinks": "^3.1.0" }, "peerDependencies": { "marked": ">=1 <16" } }, "sha512-t4rBvPsHc57uE/2nJOLmMbZCQ4tgAccAED3ngXQqW6g+TxA488JzJ+FK3lQkzBQOI1mRV/r/Kq+1ZlJ4D0owQw=="], "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="], + "mdurl": ["mdurl@2.0.0", "", {}, "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w=="], + "media-typer": ["media-typer@1.1.0", "", {}, "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw=="], "meow": ["meow@13.2.0", "", {}, "sha512-pxQJQzB6djGPXh08dacEloMFopsOqGVRKFPYvPOt9XDZ1HasbgDZA74CJGreSU4G3Ak7EFJGoiH2auq+yXISgA=="], @@ -800,6 +860,58 @@ "merge-stream": ["merge-stream@2.0.0", "", {}, "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="], + "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="], + + "micromark": ["micromark@4.0.2", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA=="], + + "micromark-core-commonmark": ["micromark-core-commonmark@2.0.3", "", { "dependencies": { "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-factory-destination": "^2.0.0", "micromark-factory-label": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-factory-title": "^2.0.0", "micromark-factory-whitespace": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-html-tag-name": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg=="], + + "micromark-extension-directive": ["micromark-extension-directive@4.0.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-factory-whitespace": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0", "parse-entities": "^4.0.0" } }, "sha512-/C2nqVmXXmiseSSuCdItCMho7ybwwop6RrrRPk0KbOHW21JKoCldC+8rFOaundDoRBUWBnJJcxeA/Kvi34WQXg=="], + + "micromark-extension-gfm-autolink-literal": ["micromark-extension-gfm-autolink-literal@2.1.0", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw=="], + + "micromark-extension-gfm-footnote": ["micromark-extension-gfm-footnote@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw=="], + + "micromark-extension-gfm-table": ["micromark-extension-gfm-table@2.1.1", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg=="], + + "micromark-extension-math": ["micromark-extension-math@3.1.0", "", { "dependencies": { "@types/katex": "^0.16.0", "devlop": "^1.0.0", "katex": "^0.16.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-lvEqd+fHjATVs+2v/8kg9i5Q0AP2k85H0WUOwpIVvUML8BapsMvh1XAogmQjOCsLpoKRCVQqEkQBB3NhVBcsOg=="], + + "micromark-factory-destination": ["micromark-factory-destination@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA=="], + + "micromark-factory-label": ["micromark-factory-label@2.0.1", "", { "dependencies": { "devlop": "^1.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg=="], + + "micromark-factory-space": ["micromark-factory-space@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg=="], + + "micromark-factory-title": ["micromark-factory-title@2.0.1", "", { "dependencies": { "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw=="], + + "micromark-factory-whitespace": ["micromark-factory-whitespace@2.0.1", "", { "dependencies": { "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ=="], + + "micromark-util-character": ["micromark-util-character@2.1.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q=="], + + "micromark-util-chunked": ["micromark-util-chunked@2.0.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0" } }, "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA=="], + + "micromark-util-classify-character": ["micromark-util-classify-character@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q=="], + + "micromark-util-combine-extensions": ["micromark-util-combine-extensions@2.0.1", "", { "dependencies": { "micromark-util-chunked": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg=="], + + "micromark-util-decode-numeric-character-reference": ["micromark-util-decode-numeric-character-reference@2.0.2", "", { "dependencies": { "micromark-util-symbol": "^2.0.0" } }, "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw=="], + + "micromark-util-encode": ["micromark-util-encode@2.0.1", "", {}, "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw=="], + + "micromark-util-html-tag-name": ["micromark-util-html-tag-name@2.0.1", "", {}, "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA=="], + + "micromark-util-normalize-identifier": ["micromark-util-normalize-identifier@2.0.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0" } }, "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q=="], + + "micromark-util-resolve-all": ["micromark-util-resolve-all@2.0.1", "", { "dependencies": { "micromark-util-types": "^2.0.0" } }, "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg=="], + + "micromark-util-sanitize-uri": ["micromark-util-sanitize-uri@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-symbol": "^2.0.0" } }, "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ=="], + + "micromark-util-subtokenize": ["micromark-util-subtokenize@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA=="], + + "micromark-util-symbol": ["micromark-util-symbol@2.0.1", "", {}, "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q=="], + + "micromark-util-types": ["micromark-util-types@2.0.2", "", {}, "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA=="], + "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="], "mime": ["mime@4.1.0", "", { "bin": { "mime": "bin/cli.js" } }, "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw=="], @@ -878,6 +990,8 @@ "parent-module": ["parent-module@1.0.1", "", { "dependencies": { "callsites": "^3.0.0" } }, "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g=="], + "parse-entities": ["parse-entities@4.0.2", "", { "dependencies": { "@types/unist": "^2.0.0", "character-entities-legacy": "^3.0.0", "character-reference-invalid": "^2.0.0", "decode-named-character-reference": "^1.0.0", "is-alphanumerical": "^2.0.0", "is-decimal": "^2.0.0", "is-hexadecimal": "^2.0.0" } }, "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw=="], + "parse-imports-exports": ["parse-imports-exports@0.2.4", "", { "dependencies": { "parse-statements": "1.0.11" } }, "sha512-4s6vd6dx1AotCx/RCI2m7t7GCh5bDRUtGNvRfHSP2wbBQdMi67pPe7mtzmgwcaQ8VKK/6IB7Glfyu3qdZJPybQ=="], "parse-json": ["parse-json@8.3.0", "", { "dependencies": { "@babel/code-frame": "^7.26.2", "index-to-position": "^1.1.0", "type-fest": "^4.39.1" } }, "sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ=="], @@ -938,8 +1052,12 @@ "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="], + "punycode.js": ["punycode.js@2.3.1", "", {}, "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA=="], + "qs": ["qs@6.15.0", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ=="], + "queue-microtask": ["queue-microtask@1.2.3", "", {}, "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A=="], + "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="], "raw-body": ["raw-body@3.0.2", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.7.0", "unpipe": "~1.0.0" } }, "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA=="], @@ -966,12 +1084,16 @@ "restore-cursor": ["restore-cursor@5.1.0", "", { "dependencies": { "onetime": "^7.0.0", "signal-exit": "^4.1.0" } }, "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA=="], + "reusify": ["reusify@1.1.0", "", {}, "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw=="], + "rfdc": ["rfdc@1.4.1", "", {}, "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA=="], "rollup": ["rollup@4.60.1", "", { "dependencies": { "@types/estree": "1.0.8" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.60.1", "@rollup/rollup-android-arm64": "4.60.1", "@rollup/rollup-darwin-arm64": "4.60.1", "@rollup/rollup-darwin-x64": "4.60.1", "@rollup/rollup-freebsd-arm64": "4.60.1", "@rollup/rollup-freebsd-x64": "4.60.1", "@rollup/rollup-linux-arm-gnueabihf": "4.60.1", "@rollup/rollup-linux-arm-musleabihf": "4.60.1", "@rollup/rollup-linux-arm64-gnu": "4.60.1", "@rollup/rollup-linux-arm64-musl": "4.60.1", "@rollup/rollup-linux-loong64-gnu": "4.60.1", "@rollup/rollup-linux-loong64-musl": "4.60.1", "@rollup/rollup-linux-ppc64-gnu": "4.60.1", "@rollup/rollup-linux-ppc64-musl": "4.60.1", "@rollup/rollup-linux-riscv64-gnu": "4.60.1", "@rollup/rollup-linux-riscv64-musl": "4.60.1", "@rollup/rollup-linux-s390x-gnu": "4.60.1", "@rollup/rollup-linux-x64-gnu": "4.60.1", "@rollup/rollup-linux-x64-musl": "4.60.1", "@rollup/rollup-openbsd-x64": "4.60.1", "@rollup/rollup-openharmony-arm64": "4.60.1", "@rollup/rollup-win32-arm64-msvc": "4.60.1", "@rollup/rollup-win32-ia32-msvc": "4.60.1", "@rollup/rollup-win32-x64-gnu": "4.60.1", "@rollup/rollup-win32-x64-msvc": "4.60.1", "fsevents": "~2.3.2" }, "bin": "dist/bin/rollup" }, "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w=="], "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="], + "run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="], + "safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="], "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="], @@ -1008,6 +1130,8 @@ "skin-tone": ["skin-tone@2.0.0", "", { "dependencies": { "unicode-emoji-modifier-base": "^1.0.0" } }, "sha512-kUMbT1oBJCpgrnKoSr0o6wPtvRWT9W9UKvGLwfJYO2WuahZRHOpEyL1ckyMGgMWh0UdpmaoFqKKD29WTomNEGA=="], + "slash": ["slash@5.1.0", "", {}, "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg=="], + "slice-ansi": ["slice-ansi@8.0.0", "", { "dependencies": { "ansi-styles": "^6.2.3", "is-fullwidth-code-point": "^5.1.0" } }, "sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg=="], "source-map": ["source-map@0.7.6", "", {}, "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ=="], @@ -1106,6 +1230,8 @@ "typescript-eslint": ["typescript-eslint@8.58.0", "", { "dependencies": { "@typescript-eslint/eslint-plugin": "8.58.0", "@typescript-eslint/parser": "8.58.0", "@typescript-eslint/typescript-estree": "8.58.0", "@typescript-eslint/utils": "8.58.0" }, "peerDependencies": { "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } }, "sha512-e2TQzKfaI85fO+F3QywtX+tCTsu/D3WW5LVU6nz8hTFKFZ8yBJ6mSYRpXqdR3mFjPWmO0eWsTa5f+UpAOe/FMA=="], + "uc.micro": ["uc.micro@2.1.0", "", {}, "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A=="], + "ufo": ["ufo@1.6.3", "", {}, "sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q=="], "uglify-js": ["uglify-js@3.19.3", "", { "bin": { "uglifyjs": "bin/uglifyjs" } }, "sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ=="], @@ -1158,7 +1284,7 @@ "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="], - "yaml": ["yaml@2.8.3", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg=="], + "yaml": ["yaml@2.7.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-+hSoy/QHluxmC9kCIJyL/uyFmLmc+e5CFR5Wa+bpIhIj85LVb9ZH2nVnqrHoSvKogwODv0ClqZkmiSSaIH5LTA=="], "yargs": ["yargs@17.7.2", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w=="], @@ -1216,6 +1342,8 @@ "cliui/wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="], + "cosmiconfig/js-yaml": ["js-yaml@4.1.1", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA=="], + "cosmiconfig/parse-json": ["parse-json@5.2.0", "", { "dependencies": { "@babel/code-frame": "^7.0.0", "error-ex": "^1.3.1", "json-parse-even-better-errors": "^2.3.0", "lines-and-columns": "^1.1.6" } }, "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg=="], "crypto-random-string/type-fest": ["type-fest@1.4.0", "", {}, "sha512-yGSza74xk0UG8k+pLh5oeoYirvIiWo5t0/o3zHHAO2tRDiZcxWP7fywNlXhqb6/r6sWvwi+RsyQMWhVLe4BVuA=="], @@ -1224,12 +1352,26 @@ "eslint/minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="], + "fast-glob/glob-parent": ["glob-parent@5.1.2", "", { "dependencies": { "is-glob": "^4.0.1" } }, "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow=="], + "global-directory/ini": ["ini@4.1.1", "", {}, "sha512-QQnnxNyfvmHFIsj7gkPcYymR8Jdw/o7mp5ZFihxn6h8Ci6fh3Dx4E1gPjpQEpIuPo9XVNY/ZUwh4BPMjGyL01g=="], + "globby/@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@2.3.0", "", {}, "sha512-LtoMMhxAlorcGhmFYI+LhPgbPZCkgP6ra1YL604EeF6U98pLlQ3iWIGMdWSC+vWmPBWBNgmDBAhnAobLROJmwg=="], + + "globby/ignore": ["ignore@7.0.5", "", {}, "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg=="], + + "globby/path-type": ["path-type@6.0.0", "", {}, "sha512-Vj7sf++t5pBD637NSfkxpHSMfWaeig5+DKWLhcqIYx6mWQz5hdJTGDVMQiJcw1ZYkhs7AazKDGpRVji1LJCZUQ=="], + + "globby/unicorn-magic": ["unicorn-magic@0.3.0", "", {}, "sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA=="], + "handlebars/source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="], "import-fresh/resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="], + "katex/commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="], + + "lint-staged/yaml": ["yaml@2.8.3", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg=="], + "load-json-file/parse-json": ["parse-json@4.0.0", "", { "dependencies": { "error-ex": "^1.3.1", "json-parse-better-errors": "^1.0.1" } }, "sha512-aOIos8bujGN93/8Ox/jPLh7RwVnPEysynVFE+fQZyg6jKELEHwzgKdLRFHUgXJL6kylijVSBC4BvN9OmsB48Rw=="], "log-update/slice-ansi": ["slice-ansi@7.1.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w=="], diff --git a/package.json b/package.json index fb4b278..e3f4eb4 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,8 @@ "horizon-mcp": "./dist/index.js" }, "files": [ - "dist/" + "dist/", + "skills/" ], "publishConfig": { "registry": "https://npm.pkg.github.com", @@ -26,10 +27,12 @@ "test:e2e:smoke": "vitest run --config vitest.config.e2e.ts tests/e2e/docs.test.ts --reporter=verbose && vitest run --config vitest.config.e2e.ts tests/e2e/horizon.test.ts -t \"exports events as CSV\" --reporter=verbose", "test:scenarios": "vitest run --config vitest.config.llm.ts --reporter=verbose", "test:llm": "bun run test:scenarios", - "validate:ci": "bun run format:check && bun run lint && bun run typecheck && bun run build && bun run verify:truth && bun run docs:diff && bun run test && bun run test:scenarios", + "validate:ci": "bun run format:check && bun run lint && bun run typecheck && bun run build && bun run verify:truth && bun run verify:skills && bun run lint:skills && bun run docs:diff && bun run test && bun run test:scenarios", "docs:refresh": "bun scripts/refresh-docs.ts", "docs:diff": "bun scripts/diff-docs.ts", "verify:truth": "bun scripts/verify-truth.ts", + "verify:skills": "bun scripts/verify-skills.ts", + "lint:skills": "markdownlint-cli2 \"skills/**/*.md\"", "lint": "eslint src/ tests/", "lint:fix": "eslint src/ tests/ --fix", "format": "prettier --write src/ tests/", @@ -60,12 +63,14 @@ "globals": "17.4.0", "husky": "9.1.7", "lint-staged": "16.4.0", + "markdownlint-cli2": "0.18.1", "prettier": "3.8.1", "semantic-release": "^25.0.3", "tsup": "8.5.1", "tsx": "4.21.0", "typescript": "6.0.2", "typescript-eslint": "8.58.0", - "vitest": "4.1.2" + "vitest": "4.1.2", + "yaml": "2.7.0" } } diff --git a/scripts/verify-skills.ts b/scripts/verify-skills.ts new file mode 100644 index 0000000..fd408cd --- /dev/null +++ b/scripts/verify-skills.ts @@ -0,0 +1,549 @@ +/** + * Verify the skills/ directory against the production-grade quality checklist. + * + * Checks: + * - canonical five-file layout per skills/setup-*\/ + * - SKILL.md frontmatter (six keys, no extras, valid types) + * - agents/openai.yaml schema and references + * - references/recipe.md has the eight required headings in order + * - references/prerequisites.yaml validates against _shared/prerequisites-schema.md + * - references/troubleshooting.md is a three-column table + * - skills/manifest.json is consistent with the directory + * - no em-dashes anywhere under skills/ + * - no evertrust.getoutline.com URLs anywhere under skills/ + * - every tool name backticked in SKILL.md or recipe.md is in the allowlist + * derived from registerTool(server, '', ...) sites under src/tools/**. + */ +import { readFileSync, readdirSync, statSync } from 'node:fs'; +import { join, relative, resolve } from 'node:path'; +import { parse as parseYaml } from 'yaml'; + +const ROOT = resolve(import.meta.dirname, '..'); +const SKILLS_DIR = join(ROOT, 'skills'); +const TOOLS_DIR = join(ROOT, 'src', 'tools'); + +const REQUIRED_FRONTMATTER_KEYS = [ + 'name', + 'description', + 'when_to_use', + 'version', + 'requires_mcp', + 'tags', +] as const; + +const REQUIRED_RECIPE_HEADINGS = [ + /^#\s.+/, // top heading + /^##\s+Architecture summary\s*$/, + /^##\s+External system prerequisites\s*$/, + /^##\s+Horizon prerequisites\s*$/, + /^##\s+External system setup steps\s*$/, + /^##\s+Horizon setup steps\s*$/, + /^##\s+Verification\s*$/, + /^##\s+Common failure points\s*$/, +] as const; + +const PREREQUISITE_REQUIRED_KEYS = [ + 'key', + 'description', + 'required', + 'sensitive', +] as const; + +const ALLOWLIST_DENYLIST = new Set([ + // Connector and module enum values - not tool names + 'evtadcs', + 'msadcs', + 'azureTenant', + 'tenant', + 'intune', + 'intunepkcs', + 'jamf', + 'webra', + 'monitored', + 'acme', + 'scep', + 'est', + 'wcce', + 'crmp', + 'digicert', + 'f5client', + 'f5as3', + // HCQL field names that look like identifiers + 'contactemail', + 'keytype', + 'discoverydata', + // YAML / placeholder tokens + 'true', + 'false', + 'null', +]); + +type Issue = { file: string; line?: number; message: string }; + +function listSkillFolders(): string[] { + return readdirSync(SKILLS_DIR) + .filter((name) => name.startsWith('setup-')) + .map((name) => join(SKILLS_DIR, name)) + .filter((p) => statSync(p).isDirectory()); +} + +function walkAll(dir: string, exts: string[]): string[] { + const out: string[] = []; + const stack = [dir]; + while (stack.length > 0) { + const current = stack.pop(); + if (!current) continue; + for (const entry of readdirSync(current)) { + const full = join(current, entry); + const st = statSync(full); + if (st.isDirectory()) { + stack.push(full); + } else if (exts.some((ext) => full.endsWith(ext))) { + out.push(full); + } + } + } + return out; +} + +function readText(path: string): string { + return readFileSync(path, 'utf-8'); +} + +function splitFrontmatter(md: string): { + frontmatter: string | null; + body: string; +} { + if (!md.startsWith('---\n')) return { frontmatter: null, body: md }; + const end = md.indexOf('\n---\n', 4); + if (end === -1) return { frontmatter: null, body: md }; + return { frontmatter: md.slice(4, end), body: md.slice(end + 5) }; +} + +function checkFrontmatter(skillFolder: string, issues: Issue[]): void { + const file = join(skillFolder, 'SKILL.md'); + let md: string; + try { + md = readText(file); + } catch { + issues.push({ file, message: 'SKILL.md is missing.' }); + return; + } + const { frontmatter } = splitFrontmatter(md); + if (frontmatter === null) { + issues.push({ + file, + message: 'Missing YAML frontmatter (must start with ---).', + }); + return; + } + let parsed: Record; + try { + parsed = parseYaml(frontmatter) as Record; + } catch (err) { + issues.push({ + file, + message: `Frontmatter is not valid YAML: ${(err as Error).message}`, + }); + return; + } + const keys = Object.keys(parsed); + for (const required of REQUIRED_FRONTMATTER_KEYS) { + if (!(required in parsed)) { + issues.push({ + file, + message: `Frontmatter missing required key: ${required}.`, + }); + } + } + for (const key of keys) { + if ( + !REQUIRED_FRONTMATTER_KEYS.includes( + key as (typeof REQUIRED_FRONTMATTER_KEYS)[number], + ) + ) { + issues.push({ file, message: `Frontmatter has unexpected key: ${key}.` }); + } + } + const description = parsed.description; + if (typeof description === 'string') { + const id = skillFolder.split('/').pop() ?? ''; + const colonForm = `setup:${id.replace(/^setup-/, '')}`; + if (!description.includes(colonForm)) { + issues.push({ + file, + message: `Frontmatter description must mention the colon-form trigger phrase: ${colonForm}.`, + }); + } + } + const tags = parsed.tags; + if (!Array.isArray(tags) || tags.length < 2) { + issues.push({ + file, + message: 'Frontmatter tags must be an array with at least two entries.', + }); + } + if (parsed.version !== '0.1.0') { + issues.push({ + file, + message: 'Frontmatter version must be "0.1.0" for v1 skills.', + }); + } + if ( + !Array.isArray(parsed.requires_mcp) || + parsed.requires_mcp.length === 0 || + !parsed.requires_mcp.includes('horizon') + ) { + issues.push({ + file, + message: 'Frontmatter requires_mcp must include "horizon".', + }); + } +} + +function checkAgentsYaml(skillFolder: string, issues: Issue[]): void { + const file = join(skillFolder, 'agents', 'openai.yaml'); + let raw: string; + try { + raw = readText(file); + } catch { + issues.push({ file, message: 'agents/openai.yaml is missing.' }); + return; + } + let parsed: Record; + try { + parsed = parseYaml(raw) as Record; + } catch (err) { + issues.push({ + file, + message: `agents/openai.yaml is not valid YAML: ${(err as Error).message}`, + }); + return; + } + if (parsed.schema !== 'openai-skill-agent/v1') { + issues.push({ + file, + message: 'agents/openai.yaml schema must be "openai-skill-agent/v1".', + }); + } + if (typeof parsed.model !== 'string' || parsed.model.length === 0) { + issues.push({ + file, + message: + 'agents/openai.yaml model must be a non-empty string (no deferral).', + }); + } + const tools = parsed.tools; + if (!Array.isArray(tools) || !tools.includes('horizon')) { + issues.push({ + file, + message: 'agents/openai.yaml tools must include "horizon".', + }); + } + const prompts = parsed.prompts as + | { system?: string; references?: string[] } + | undefined; + if (!prompts || prompts.system !== './SKILL.md') { + issues.push({ + file, + message: 'agents/openai.yaml prompts.system must be "./SKILL.md".', + }); + } + const expectedRefs = [ + './references/recipe.md', + './references/prerequisites.yaml', + './references/troubleshooting.md', + ]; + for (const ref of expectedRefs) { + if (!prompts?.references?.includes(ref)) { + issues.push({ + file, + message: `agents/openai.yaml prompts.references must include ${ref}.`, + }); + } + } +} + +function checkRecipeHeadings(skillFolder: string, issues: Issue[]): void { + const file = join(skillFolder, 'references', 'recipe.md'); + let body: string; + try { + body = readText(file); + } catch { + issues.push({ file, message: 'references/recipe.md is missing.' }); + return; + } + const lines = body.split('\n'); + let cursor = 0; + for (const [index, pattern] of REQUIRED_RECIPE_HEADINGS.entries()) { + const matchIndex = lines.findIndex( + (line, i) => i >= cursor && pattern.test(line), + ); + if (matchIndex === -1) { + issues.push({ + file, + message: `Required heading #${index + 1} not found (pattern: ${pattern}).`, + }); + return; + } + cursor = matchIndex + 1; + } +} + +function checkPrerequisitesYaml(skillFolder: string, issues: Issue[]): void { + const file = join(skillFolder, 'references', 'prerequisites.yaml'); + let raw: string; + try { + raw = readText(file); + } catch { + issues.push({ file, message: 'references/prerequisites.yaml is missing.' }); + return; + } + let parsed: Record; + try { + parsed = parseYaml(raw) as Record; + } catch (err) { + issues.push({ + file, + message: `references/prerequisites.yaml is not valid YAML: ${(err as Error).message}`, + }); + return; + } + if (parsed.schema_version !== '1') { + issues.push({ file, message: 'schema_version must be "1".' }); + } + const list = parsed.prerequisites; + if (!Array.isArray(list) || list.length === 0) { + issues.push({ file, message: 'prerequisites must be a non-empty array.' }); + return; + } + for (const [i, entry] of list.entries()) { + if (typeof entry !== 'object' || entry === null) { + issues.push({ file, message: `prerequisites[${i}] must be an object.` }); + continue; + } + const obj = entry as Record; + for (const key of PREREQUISITE_REQUIRED_KEYS) { + if (!(key in obj)) { + issues.push({ + file, + message: `prerequisites[${i}] missing required field: ${key}.`, + }); + } + } + if ('validator' in obj && 'enum' in obj) { + issues.push({ + file, + message: `prerequisites[${i}] has both validator and enum, which are mutually exclusive.`, + }); + } + if (obj.required === false && !('default' in obj)) { + issues.push({ + file, + message: `prerequisites[${i}] is optional but has no default value.`, + }); + } + } +} + +function checkTroubleshooting(skillFolder: string, issues: Issue[]): void { + const file = join(skillFolder, 'references', 'troubleshooting.md'); + let body: string; + try { + body = readText(file); + } catch { + issues.push({ file, message: 'references/troubleshooting.md is missing.' }); + return; + } + if (!/\|\s*Problem\s*\|\s*Possible Cause\s*\|\s*Solution\s*\|/i.test(body)) { + issues.push({ + file, + message: + 'troubleshooting.md must contain a Problem | Possible Cause | Solution table header.', + }); + } +} + +function checkManifest(issues: Issue[]): void { + const file = join(SKILLS_DIR, 'manifest.json'); + const manifest = JSON.parse(readText(file)) as { + schema_version: string; + skills: { + id: string; + description: string; + tags: string[]; + version: string; + }[]; + }; + if (manifest.schema_version !== '1') { + issues.push({ file, message: 'manifest schema_version must be "1".' }); + } + const folders = listSkillFolders().map((p) => p.split('/').pop() ?? ''); + const ids = manifest.skills.map((s) => s.id); + for (const folder of folders) { + if (!ids.includes(folder)) { + issues.push({ + file, + message: `manifest is missing entry for ${folder}.`, + }); + } + } + for (const id of ids) { + if (!folders.includes(id)) { + issues.push({ + file, + message: `manifest entry ${id} has no matching folder.`, + }); + } + const skill = manifest.skills.find((s) => s.id === id); + if (skill && skill.version !== '0.1.0') { + issues.push({ + file, + message: `manifest entry ${id} version must be "0.1.0".`, + }); + } + const colonForm = `setup:${id.replace(/^setup-/, '')}`; + if (skill && !skill.tags.includes(colonForm)) { + issues.push({ + file, + message: `manifest entry ${id} tags must include the colon-form trigger ${colonForm}.`, + }); + } + } +} + +function checkNoEmDashesOrPrivateUrls(issues: Issue[]): void { + const files = walkAll(SKILLS_DIR, ['.md', '.yaml', '.json']); + for (const file of files) { + const body = readText(file); + const lines = body.split('\n'); + for (const [i, line] of lines.entries()) { + if (line.includes('—')) { + issues.push({ + file, + line: i + 1, + message: 'Em-dash detected. Use a regular dash.', + }); + } + if (/evertrust\.getoutline\.com/i.test(line)) { + issues.push({ + file, + line: i + 1, + message: 'Private Outline URL detected.', + }); + } + } + } +} + +function buildToolAllowlist(): Set { + const tools = new Set(); + const files = walkAll(TOOLS_DIR, ['.ts']).filter( + (f) => !f.endsWith('register.ts') && !f.endsWith('guidance.ts'), + ); + const pattern = /registerTool\s*\(\s*server\s*,\s*['"]([a-z][a-z0-9_]+)['"]/g; + for (const file of files) { + const body = readText(file); + for (const match of body.matchAll(pattern)) { + tools.add(match[1]); + } + } + return tools; +} + +function loadFutureToolNames(): Set { + const file = join(SKILLS_DIR, '_shared', 'tool-gap-signaling.md'); + const body = readText(file); + const out = new Set(); + const pattern = /^\s*-\s+`?([a-z][a-z0-9_]+)`?\s*:/gm; + for (const match of body.matchAll(pattern)) { + out.add(match[1]); + } + return out; +} + +function checkToolAllowlist(issues: Issue[]): void { + const allowlist = buildToolAllowlist(); + const futureTools = loadFutureToolNames(); + const targetFiles: string[] = []; + for (const folder of listSkillFolders()) { + targetFiles.push(join(folder, 'SKILL.md')); + targetFiles.push(join(folder, 'references', 'recipe.md')); + } + const backtickedIdent = /`([a-z][a-z0-9_]+)`/g; + for (const file of targetFiles) { + let body: string; + try { + body = readText(file); + } catch { + continue; + } + for (const match of body.matchAll(backtickedIdent)) { + const name = match[1]; + if (ALLOWLIST_DENYLIST.has(name)) continue; + if (allowlist.has(name)) continue; + if (futureTools.has(name)) continue; + // We only flag identifiers that look like tool names (snake_case with underscore). + if (!name.includes('_')) continue; + issues.push({ + file, + message: `Backticked identifier "${name}" is not in the tool allowlist or in tool-gap-signaling.md.`, + }); + } + } +} + +function main(): void { + const issues: Issue[] = []; + + // Folder layout + for (const folder of listSkillFolders()) { + const expected = [ + ['SKILL.md'], + ['agents', 'openai.yaml'], + ['references', 'recipe.md'], + ['references', 'prerequisites.yaml'], + ['references', 'troubleshooting.md'], + ]; + for (const parts of expected) { + const target = join(folder, ...parts); + try { + statSync(target); + } catch { + issues.push({ + file: target, + message: `Missing required skill file: ${parts.join('/')}.`, + }); + } + } + } + + // Per-skill checks + for (const folder of listSkillFolders()) { + checkFrontmatter(folder, issues); + checkAgentsYaml(folder, issues); + checkRecipeHeadings(folder, issues); + checkPrerequisitesYaml(folder, issues); + checkTroubleshooting(folder, issues); + } + + // Repo-level checks + checkManifest(issues); + checkNoEmDashesOrPrivateUrls(issues); + checkToolAllowlist(issues); + + if (issues.length === 0) { + console.log('verify-skills: OK'); + return; + } + + console.error(`verify-skills: ${issues.length} issue(s) found`); + for (const issue of issues) { + const rel = relative(ROOT, issue.file); + const where = issue.line ? `${rel}:${issue.line}` : rel; + console.error(` ${where}: ${issue.message}`); + } + process.exit(1); +} + +main(); diff --git a/tests/unit/skills.test.ts b/tests/unit/skills.test.ts new file mode 100644 index 0000000..31a183c --- /dev/null +++ b/tests/unit/skills.test.ts @@ -0,0 +1,172 @@ +import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'; +import { join, resolve } from 'node:path'; +import { describe, expect, it } from 'vitest'; +import { parse as parseYaml } from 'yaml'; + +const ROOT = resolve(__dirname, '..', '..'); +const SKILLS_DIR = join(ROOT, 'skills'); + +function skillFolders(): string[] { + return readdirSync(SKILLS_DIR) + .filter((name) => name.startsWith('setup-')) + .map((name) => join(SKILLS_DIR, name)) + .filter((p) => statSync(p).isDirectory()); +} + +function readText(path: string): string { + return readFileSync(path, 'utf-8'); +} + +function readFrontmatter(skillFolder: string): Record { + const md = readText(join(skillFolder, 'SKILL.md')); + expect(md.startsWith('---\n')).toBe(true); + const end = md.indexOf('\n---\n', 4); + expect(end).toBeGreaterThan(0); + return parseYaml(md.slice(4, end)) as Record; +} + +describe('skills/manifest.json', () => { + it('exists and is parseable', () => { + const file = join(SKILLS_DIR, 'manifest.json'); + expect(existsSync(file)).toBe(true); + const parsed = JSON.parse(readText(file)) as { + schema_version: string; + skills: unknown[]; + }; + expect(parsed.schema_version).toBe('1'); + expect(Array.isArray(parsed.skills)).toBe(true); + expect(parsed.skills.length).toBeGreaterThan(0); + }); + + it('lists every setup-* folder', () => { + const file = join(SKILLS_DIR, 'manifest.json'); + const parsed = JSON.parse(readText(file)) as { skills: { id: string }[] }; + const ids = parsed.skills.map((s) => s.id); + const folders = skillFolders().map((p) => p.split('/').pop() ?? ''); + for (const folder of folders) { + expect(ids).toContain(folder); + } + }); +}); + +describe.each( + skillFolders().map((folder) => [folder.split('/').pop() ?? '', folder]), +)('skill %s', (name, folder) => { + it('has the canonical five-file layout', () => { + const expected = [ + ['SKILL.md'], + ['agents', 'openai.yaml'], + ['references', 'recipe.md'], + ['references', 'prerequisites.yaml'], + ['references', 'troubleshooting.md'], + ]; + for (const parts of expected) { + expect(existsSync(join(folder, ...parts))).toBe(true); + } + }); + + it('SKILL.md has the six required frontmatter keys', () => { + const fm = readFrontmatter(folder); + for (const key of [ + 'name', + 'description', + 'when_to_use', + 'version', + 'requires_mcp', + 'tags', + ]) { + expect(fm).toHaveProperty(key); + } + expect(fm.version).toBe('0.1.0'); + expect(fm.requires_mcp).toEqual(expect.arrayContaining(['horizon'])); + }); + + it('frontmatter description includes the colon-form trigger phrase', () => { + const fm = readFrontmatter(folder); + const colonForm = `setup:${name.replace(/^setup-/, '')}`; + expect(typeof fm.description).toBe('string'); + expect((fm.description as string).includes(colonForm)).toBe(true); + }); + + it('agents/openai.yaml has schema and references', () => { + const yaml = parseYaml( + readText(join(folder, 'agents', 'openai.yaml')), + ) as Record; + expect(yaml.schema).toBe('openai-skill-agent/v1'); + expect(typeof yaml.model).toBe('string'); + expect((yaml.model as string).length).toBeGreaterThan(0); + const prompts = yaml.prompts as { system?: string; references?: string[] }; + expect(prompts.system).toBe('./SKILL.md'); + expect(prompts.references).toEqual( + expect.arrayContaining([ + './references/recipe.md', + './references/prerequisites.yaml', + './references/troubleshooting.md', + ]), + ); + }); + + it('references/recipe.md has all eight required headings in order', () => { + const body = readText(join(folder, 'references', 'recipe.md')); + const lines = body.split('\n'); + const required = [ + /^#\s.+/, + /^##\s+Architecture summary\s*$/, + /^##\s+External system prerequisites\s*$/, + /^##\s+Horizon prerequisites\s*$/, + /^##\s+External system setup steps\s*$/, + /^##\s+Horizon setup steps\s*$/, + /^##\s+Verification\s*$/, + /^##\s+Common failure points\s*$/, + ]; + let cursor = 0; + for (const pattern of required) { + const idx = lines.findIndex( + (line, i) => i >= cursor && pattern.test(line), + ); + expect(idx, `heading not found: ${pattern}`).toBeGreaterThanOrEqual(0); + cursor = idx + 1; + } + }); + + it('references/prerequisites.yaml validates against schema', () => { + const yaml = parseYaml( + readText(join(folder, 'references', 'prerequisites.yaml')), + ) as Record; + expect(yaml.schema_version).toBe('1'); + const list = yaml.prerequisites as Record[]; + expect(Array.isArray(list)).toBe(true); + for (const entry of list) { + for (const key of ['key', 'description', 'required', 'sensitive']) { + expect(entry).toHaveProperty(key); + } + } + }); + + it('contains no em-dashes', () => { + const files = [ + 'SKILL.md', + 'references/recipe.md', + 'references/troubleshooting.md', + ]; + for (const rel of files) { + const body = readText(join(folder, rel)); + expect(body.includes('—'), `em-dash in ${rel}`).toBe(false); + } + }); + + it('contains no private Outline URL', () => { + const files = [ + 'SKILL.md', + 'references/recipe.md', + 'references/troubleshooting.md', + ]; + for (const rel of files) { + const body = readText(join(folder, rel)); + expect( + /evertrust\.getoutline\.com/i.test(body), + `outline URL in ${rel}`, + ).toBe(false); + } + }); +}); From 702ac55112c525312cc3763210d63a06968880be Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 17:03:06 +0200 Subject: [PATCH 5/9] feat: add setup-adcs skill Add the five-file Microsoft ADCS setup recipe under skills/setup-adcs/ covering both evtadcs (recommended) and msadcs variants. Also extend the verify-skills denylist with common Horizon field names. --- scripts/verify-skills.ts | 24 ++++ skills/setup-adcs/SKILL.md | 84 ++++++++++++ skills/setup-adcs/agents/openai.yaml | 15 +++ .../setup-adcs/references/prerequisites.yaml | 121 ++++++++++++++++++ skills/setup-adcs/references/recipe.md | 72 +++++++++++ .../setup-adcs/references/troubleshooting.md | 12 ++ 6 files changed, 328 insertions(+) create mode 100644 skills/setup-adcs/SKILL.md create mode 100644 skills/setup-adcs/agents/openai.yaml create mode 100644 skills/setup-adcs/references/prerequisites.yaml create mode 100644 skills/setup-adcs/references/recipe.md create mode 100644 skills/setup-adcs/references/troubleshooting.md diff --git a/scripts/verify-skills.ts b/scripts/verify-skills.ts index fd408cd..75e4694 100644 --- a/scripts/verify-skills.ts +++ b/scripts/verify-skills.ts @@ -72,6 +72,30 @@ const ALLOWLIST_DENYLIST = new Set([ 'contactemail', 'keytype', 'discoverydata', + // Horizon field names (snake_case) used in skill bodies + 'display_name', + 'name_contains', + 'trigger_type', + 'credential_type', + 'max_items', + 'pki_connector', + 'pkiconnector', + 'thirdpartyconnector', + 'triggerhooks', + 'client_id', + 'client_secret', + 'azure_tenant', + 'legacy_revocation_mode', + 'pub_key', + 'key_name', + 'product_id', + 'organization_id', + 'base_url', + 'api_credentials', + 'self_link', + 'user_references', + 'resource_group_references', + 'partition_access', // YAML / placeholder tokens 'true', 'false', diff --git a/skills/setup-adcs/SKILL.md b/skills/setup-adcs/SKILL.md new file mode 100644 index 0000000..c0cfacd --- /dev/null +++ b/skills/setup-adcs/SKILL.md @@ -0,0 +1,84 @@ +--- +name: setup-adcs +description: "Walks the user through end-to-end setup of a Microsoft ADCS integration on a live Horizon CLM instance, asking for every prerequisite up front and verifying state at every step using the horizon MCP tools. Triggers: setup:adcs, /setup-adcs, set up ADCS, configure ADCS connector, Microsoft ADCS integration." +when_to_use: "User wants to integrate a Microsoft Active Directory Certificate Services (ADCS) instance with Horizon and starts from a blank or vanilla state, or asks to configure an ADCS PKI connector." +version: 0.1.0 +requires_mcp: + - horizon +tags: + - setup:adcs + - /setup-adcs + - set up ADCS + - configure ADCS connector + - Microsoft ADCS integration +--- + +This skill walks the user through configuring a Microsoft ADCS integration on a live Evertrust Horizon CLM instance. The full procedural recipe lives in `references/recipe.md`. The exhaustive prerequisite list lives in `references/prerequisites.yaml`. Symptom and fix table lives in `references/troubleshooting.md`. Read all three before producing guidance. + +Object names in Horizon are immutable primary keys. Never invent a name. Always ask the user for both `name` and `display_name`. All HCQL field names are lowercase. + +## Phase 0 - Preflight (MANDATORY) + +Follow `skills/_shared/preflight-template.md`. For this skill, the required modules check is `webra` in `licensedModules`. The required knowledge resources are `horizon://knowledge/adcs-integration`, `horizon://knowledge/profiles`, and `horizon://knowledge/architecture`. + +If preflight fails on any step, STOP and report the gap to the user. Do not advance. + +## Phase 1 - External MCP / Skill / Knowledge Discovery + +Run the regex `^mcp__.*(microsoft|adcs|active.?directory|windows.?server).*` (case-insensitive) against the names of every MCP tool currently exposed in the session. Record matching names in `discoveredCapabilities`. + +If a Microsoft / ADCS MCP is found, mention it to the user and ask whether to use it for any Phase 3 step (template permission grant, technical account creation, etc.). If no hit, fall back to the embedded recipe in `references/recipe.md`. Do NOT pretend a capability exists. + +## Phase 2 - Prerequisites (HARD GATE) + +Drive `AskUserQuestion` (or the host equivalent in `skills/_shared/host-primitives.md`) from `references/prerequisites.yaml`. Group the questions in this order so the user can pause without losing context: + +1. Variant choice: `ADCS_VARIANT`. +2. ADCS topology: `AD_NETBIOS_NAME`, `ADCS_CONNECTOR_URL`, `ADCS_CERTIFICATE_TEMPLATE`, `ADCS_CA_CONFIG` (skip the NetBIOS / CA Config questions when `ADCS_VARIANT` is `msadcs`). +3. Trust material: `ISSUING_CA_PEM`, `CRLDP_URL`, `HORIZON_CRL_FALLBACK_POLICY`. +4. Sensitive material: `ADCS_ENROLLMENT_AGENT_P12`, `ADCS_ENROLLMENT_AGENT_PASSPHRASE`, `ADCS_TECHNICAL_ACCOUNT_LOGIN`, `ADCS_TECHNICAL_ACCOUNT_PASSWORD`. Mark these `sensitive` and never echo them back. +5. Horizon object names: `ADCS_ENROLLMENT_AGENT_P12_NAME`, `ADCS_ENROLLMENT_AGENT_P12_DISPLAY_NAME`, `ADCS_TECHNICAL_ACCOUNT_LOGIN_NAME`, `ADCS_TECHNICAL_ACCOUNT_LOGIN_DISPLAY_NAME`, `PKI_CONNECTOR_NAME`, `PKI_CONNECTOR_DISPLAY_NAME`, `PROFILE_NAME`. + +Refuse to advance to Phase 3 until every required value is captured. For sensitive prerequisites, accept the value but never print it back; print `` instead. + +## Phase 3 - External System Setup + +Walk `references/recipe.md` section "External system setup steps" verbatim. After every numbered step, ask "Confirm step complete? (yes/no)". Do not advance on anything but a `yes`. + +If `discoveredCapabilities` from Phase 1 includes a Microsoft / ADCS MCP that can perform a step, propose using it (with the standard mutating-tool confirmation prompt) before falling back to the manual instruction. + +## Phase 4 - Horizon Configuration + +Walk `references/recipe.md` section "Horizon setup steps" verbatim. For each step: + +1. Run the matching read tool to detect existing objects by name (`list_credentials` for credentials, `get_profile` for profiles). For PKI connectors and certification authorities there is currently no MCP read tool; ask the user to confirm from the UI whether the named object already exists. +2. If the object already exists, ask `reuse / rename / abort` and act on the answer. Reuse means skipping the create. Rename means going back to Phase 2 to capture a new name. +3. If creating a new object, print the exact UI navigation text from the recipe with the resolved values inserted. For sensitive fields print `` not the value. +4. After the user reports the create complete, re-run the read tool and confirm the object is present. + +The skill never calls a mutating MCP tool in Phase 4 unless the host explicitly maps a Horizon UI action to one of the available mutating tools (currently none for credentials, PKI connectors, profiles, or certification authorities). When a mutating tool IS called, gate it behind the confirmation pattern in `skills/_shared/host-primitives.md`. + +## Phase 5 - End-to-End Test + +Run the verification calls in `references/recipe.md` section "Verification" in order: + +1. `get_profile` against `PROFILE_NAME`. +2. `get_request_template` against `PROFILE_NAME` with `workflow: enroll`. +3. `submit_request` (mutating, gate behind confirmation) using only the fields returned by step 2. +4. `search_certificates` with the HCQL `module equals "webra" and profile equals ""`. +5. `decode_x509` on the issued certificate. + +If any step fails, jump to Phase 6. + +## Phase 6 - Troubleshooting + +Use `references/troubleshooting.md` to map symptoms to fixes. + +## Missing MCP Tools + +These tools would automate steps that today require a UI walk. They are listed in `skills/_shared/tool-gap-signaling.md`: + +- `create_credential`: create a Horizon credential of type login or certificate-pkcs12 and assign its target. +- `list_pki_connectors`, `get_pki_connector`, `create_pki_connector`: enumerate, fetch, and create the ADCS PKI connector without leaving the chat. +- `create_certification_authority`, `list_certification_authorities`: import the issuing CA, set CRL URL and Trust for Server Authentication. +- `create_profile`, `update_profile`: bind the new connector to a profile. diff --git a/skills/setup-adcs/agents/openai.yaml b/skills/setup-adcs/agents/openai.yaml new file mode 100644 index 0000000..c94e147 --- /dev/null +++ b/skills/setup-adcs/agents/openai.yaml @@ -0,0 +1,15 @@ +schema: openai-skill-agent/v1 +agent_name: setup-adcs +model: gpt-5 +tools: + - horizon +prompts: + system: ./SKILL.md + references: + - ./references/recipe.md + - ./references/prerequisites.yaml + - ./references/troubleshooting.md +guardrails: + require_user_confirmation_before_mutating: true + require_full_prerequisites_before_walkthrough: true + redact_sensitive_prerequisites: true diff --git a/skills/setup-adcs/references/prerequisites.yaml b/skills/setup-adcs/references/prerequisites.yaml new file mode 100644 index 0000000..9c19472 --- /dev/null +++ b/skills/setup-adcs/references/prerequisites.yaml @@ -0,0 +1,121 @@ +schema_version: "1" +prerequisites: + - key: ADCS_VARIANT + description: "Connector variant to deploy. evtadcs uses the EverTrust ADCS Connector (recommended). msadcs uses the legacy Microsoft ADCS Web connector." + required: true + sensitive: false + enum: ["evtadcs", "msadcs"] + default: "evtadcs" + + - key: AD_NETBIOS_NAME + description: "NetBIOS name of the Active Directory forest the ADCS belongs to. Uppercase, 1 to 15 characters, no dots." + required: true + sensitive: false + validator: "^[A-Z0-9-]{1,15}$" + example: "CORP" + + - key: ADCS_CONNECTOR_URL + description: "Base URL of the EverTrust ADCS Connector with explicit scheme and port. Default port is 4443." + required: true + sensitive: false + validator: "^https://[A-Za-z0-9.-]+:[0-9]+$" + example: "https://adcs01.corp.example.com:4443" + + - key: ISSUING_CA_PEM + description: "Full PEM body of the TLS certificate (and optionally its chain) that fronts the EverTrust ADCS Connector. Horizon trusts this CA to validate the connector HTTPS certificate." + required: true + sensitive: false + validator: "^-----BEGIN CERTIFICATE-----" + + - key: CRLDP_URL + description: "CRL Distribution Point URL of the issuing CA used by Horizon to validate the ADCS Connector TLS certificate." + required: true + sensitive: false + validator: "^https?://.+" + example: "http://crldp.corp.example.com/issuing-ca.crl" + + - key: ADCS_CERTIFICATE_TEMPLATE + description: "Microsoft ADCS certificate template name. Must match the template name on the CA byte-for-byte (case-sensitive)." + required: true + sensitive: false + example: "WebServer" + + - key: ADCS_CA_CONFIG + description: "ADCS CA configuration string in the form CA_HOST\\CA_NAME (single backslash)." + required: true + sensitive: false + validator: "^[^\\\\]+\\\\[^\\\\]+$" + example: "CA01\\Corp Issuing CA" + + - key: ADCS_ENROLLMENT_AGENT_P12 + description: "Enrollment Agent PKCS#12 bundle. Provide an absolute path to a .p12 / .pfx file or a base64-encoded blob. Used by Horizon to enroll on behalf of end entities." + required: true + sensitive: true + + - key: ADCS_ENROLLMENT_AGENT_PASSPHRASE + description: "Passphrase that protects the Enrollment Agent PKCS#12. Must be at least 8 characters." + required: true + sensitive: true + validator: ".{8,}" + + - key: ADCS_ENROLLMENT_AGENT_P12_NAME + description: "Immutable name for the Horizon credential that stores the Enrollment Agent PKCS#12. Cannot change after creation." + required: true + sensitive: false + example: "adcs-enrollment-agent" + + - key: ADCS_ENROLLMENT_AGENT_P12_DISPLAY_NAME + description: "Human-friendly display name shown in the Horizon UI for the Enrollment Agent credential." + required: true + sensitive: false + example: "ADCS Enrollment Agent" + + - key: ADCS_TECHNICAL_ACCOUNT_LOGIN + description: "Active Directory technical account login in DOMAIN\\username form. Must have Read and Enroll on the certificate template, and Issue and Manage Certificates on the CA. Must not be a GMSA." + required: true + sensitive: true + validator: "^[A-Z0-9-]+\\\\[^\\\\]+$" + example: "CORP\\svc-horizon" + + - key: ADCS_TECHNICAL_ACCOUNT_PASSWORD + description: "Password for the Active Directory technical account." + required: true + sensitive: true + validator: ".+" + + - key: ADCS_TECHNICAL_ACCOUNT_LOGIN_NAME + description: "Immutable name for the Horizon credential that stores the AD technical account login." + required: true + sensitive: false + example: "adcs-technical-account" + + - key: ADCS_TECHNICAL_ACCOUNT_LOGIN_DISPLAY_NAME + description: "Human-friendly display name shown in the Horizon UI for the technical account credential." + required: true + sensitive: false + example: "ADCS Technical Account" + + - key: HORIZON_CRL_FALLBACK_POLICY + description: "Behavior when the CRL Distribution Point is unreachable from Horizon. Last available status keeps trusting the cert based on the previous CRL." + required: false + sensitive: false + enum: ["Last available status", "Strict"] + default: "Last available status" + + - key: PKI_CONNECTOR_NAME + description: "Immutable name for the new PKI connector. Cannot change after creation." + required: true + sensitive: false + example: "adcs-webserver" + + - key: PKI_CONNECTOR_DISPLAY_NAME + description: "Human-friendly display name shown in the Horizon UI for the PKI connector." + required: true + sensitive: false + example: "ADCS WebServer Template" + + - key: PROFILE_NAME + description: "Existing Horizon profile to bind to this PKI connector via pkiConnector. Use __NEW__ to skip binding (a profile must be created manually before issuance)." + required: true + sensitive: false + default: "__NEW__" diff --git a/skills/setup-adcs/references/recipe.md b/skills/setup-adcs/references/recipe.md new file mode 100644 index 0000000..02fcdd2 --- /dev/null +++ b/skills/setup-adcs/references/recipe.md @@ -0,0 +1,72 @@ +# Microsoft ADCS Integration Recipe + +## Architecture summary + +Horizon manages the full certificate lifecycle (enrollment, renewal, revocation) through a Microsoft ADCS Certification Authority by talking to the EverTrust ADCS Connector over HTTPS. The connector runs inside the Active Directory forest (either on the ADCS server itself or on a domain-joined host with the AD CS RSAT tools installed) and exposes a REST endpoint on TCP/4443. Horizon authenticates to the connector with a PKCS#12 Enrollment Agent certificate and authenticates to Active Directory with an AD technical account. + +Each Microsoft ADCS certificate template that Horizon needs to manage is fronted by its own dedicated PKI connector. Horizon stores credentials separately from connectors so the same enrollment agent and technical account can be reused across multiple template-bound connectors without copy-paste. + +A second variant exists for legacy Microsoft ADCS Web (`msadcs`). It does not require the AD NetBIOS name nor the CA Config string because it talks directly to the ADCS web frontend. The `evtadcs` variant is recommended whenever the EverTrust ADCS Connector is available. + +## External system prerequisites + +| Item | Description | +|------|-------------| +| AD forest with ADCS | The forest must already contain a configured ADCS Certification Authority. | +| ADCS certificate template | The template the connector will issue from must already exist on the CA. | +| Technical account | An AD user account that is not a GMSA, with no interactive logon rights. | +| Template permissions | Grant Read and Enroll on the template to the technical account. | +| CA permissions | Grant Issue and Manage Certificates on the CA to the technical account. | +| Enrollment Agent certificate | A PKCS#12 bundle issued by ADCS for the technical account, used for enroll-on-behalf-of operations. | +| EverTrust ADCS Connector deployed | Installed on the ADCS host or a domain-joined host with the AD CS RSAT tools, listening on TCP/4443. | +| Connector TLS certificate | A TLS certificate (issued by an internal CA) that fronts the connector HTTPS endpoint. | +| CRL Distribution Point | The CRLDP of the issuing CA must be reachable from Horizon over TCP/80. | +| Network flows | Horizon to connector on TCP/4443. Horizon to CRLDP on TCP/80. | + +## Horizon prerequisites + +| Item | Description | +|------|-------------| +| Admin login | A user account in Horizon with Configuration permissions on Certification Authorities, Credentials, PKI Connectors, and Profiles. | +| WebRA module licensed | Required for issuing certificates against the ADCS via Horizon enrollment workflows. | +| Outbound connectivity | Horizon must reach the ADCS Connector and the CRLDP from its own network. | +| Existing or new profile | Either pick an existing WebRA profile to bind the new connector to, or plan a new profile after the connector exists. | + +## External system setup steps + +1. Confirm the ADCS certificate template name and the CA Config string (`CA_HOST\CA_NAME`). +2. Create the technical account in Active Directory if not already present. Disable interactive logon. Confirm it is not a Group Managed Service Account. +3. On the ADCS, grant Read and Enroll on the certificate template to the technical account. +4. On the ADCS, grant Issue and Manage Certificates on the CA to the technical account. +5. Issue and export an Enrollment Agent certificate for the technical account as a PKCS#12 bundle. Record its passphrase securely; it must match `ADCS_ENROLLMENT_AGENT_PASSPHRASE`. +6. Install the EverTrust ADCS Connector on the ADCS host or a domain-joined host with the AD CS RSAT tools. Configure its `EverTrustADCSConnector.exe.config` with the `CertHash` of the connector TLS certificate. +7. Verify locally on the connector host that `https://localhost:4443/api/certificate` returns OK. +8. Verify from Horizon that TCP/4443 to the connector and TCP/80 to the CRLDP are reachable. + +## Horizon setup steps + +1. Trust the issuing CA. Open Certification Authorities and import the connector TLS certificate's issuing CA. Set CRL URL to `CRLDP_URL`. Enable Trust for Server Authentication. Set Outdated revocation status policy to `HORIZON_CRL_FALLBACK_POLICY` (default `Last available status`). The `horizon` MCP server does not currently expose a list tool for CAs, so verification at this step is a manual UI confirmation that the CA shows up under Certification Authorities. +2. Open Security > Credentials and create a Certificate (PKCS#12) credential targeting PKI Connectors. Set name to `ADCS_ENROLLMENT_AGENT_P12_NAME`, display name to `ADCS_ENROLLMENT_AGENT_P12_DISPLAY_NAME`. Upload the Enrollment Agent PKCS#12 and supply the passphrase. Verify with `list_credentials` filtered by `name_contains: `. +3. Open Security > Credentials and create a Login credential targeting PKI Connectors. Set name to `ADCS_TECHNICAL_ACCOUNT_LOGIN_NAME`, display name to `ADCS_TECHNICAL_ACCOUNT_LOGIN_DISPLAY_NAME`. Set login to `ADCS_TECHNICAL_ACCOUNT_LOGIN` and password to `ADCS_TECHNICAL_ACCOUNT_PASSWORD`. Verify with `list_credentials`. +4. Open PKI > Connectors and create the connector with the variant chosen during preflight. For `evtadcs` set Endpoint to `ADCS_CONNECTOR_URL`, AD Domain NetBIOS Name to `AD_NETBIOS_NAME`, MS ADCS Certificate Template Name to `ADCS_CERTIFICATE_TEMPLATE`, CA Config to `ADCS_CA_CONFIG`. Wire Enrollment Agent credentials to the credential created in step 2 and MS ADCS technical credentials to the credential created in step 3. Save. The MCP server does not currently expose a list tool for PKI connectors, so verification at this step is reading the Success status from the UI. +5. If `PROFILE_NAME` is `__NEW__`, create a WebRA profile that references the new connector via `pkiConnector`. Otherwise update the existing profile so its `pkiConnector` field equals `PKI_CONNECTOR_NAME`. Verify with `get_profile`. + +## Verification + +1. `get_profile` against `PROFILE_NAME` confirms `pkiConnector` equals `PKI_CONNECTOR_NAME`. +2. `get_request_template` against `PROFILE_NAME` with `workflow: enroll` returns the enrollment field set required by the underlying ADCS template. Per the global Horizon rule, `submit_request` is never called without first calling `get_request_template`. +3. After explicit user confirmation, run a single test `submit_request` filling only the fields returned by step 2. +4. `search_certificates` with the HCQL query `module equals "webra" and profile equals ""` returns the issued certificate. +5. `decode_x509` on the issued certificate confirms its issuer chain matches the CA imported in Horizon setup step 1. + +All HCQL field names are lowercase. The query above uses `module` and `profile`, not `Module` or `Profile`. + +## Common failure points + +| Symptom | Cause | Fix | +|---------|-------|-----| +| Connector status reports Error after creation. | CRLDP not reachable from Horizon, or the issuing CA TLS cert is rejected. | Set Outdated revocation status policy to Last available status. | +| Enrollment fails authentication. | Technical account lacks Read+Enroll on the template or Issue and Manage Certificates on the CA. | Grant the missing permissions on the ADCS console. | +| Mixing `evtadcs` and `msadcs` field sets. | The two variants have different required fields. | Pick one variant during Phase 2 and stay with it. | +| `submit_request` rejects payload as missing fields. | `get_request_template` was skipped. | Always call `get_request_template` before `submit_request`. | +| Certificates issued but the chain does not match the imported CA. | Multiple ADCS instances issue with the same template. | Confirm `ADCS_CA_CONFIG` matches the CA recorded in Horizon. | diff --git a/skills/setup-adcs/references/troubleshooting.md b/skills/setup-adcs/references/troubleshooting.md new file mode 100644 index 0000000..7fb6054 --- /dev/null +++ b/skills/setup-adcs/references/troubleshooting.md @@ -0,0 +1,12 @@ +# ADCS Setup Troubleshooting + +| Problem | Possible Cause | Solution | +|---------|----------------|----------| +| Connector status: Error after creation. | The CRL Distribution Point is not reachable from Horizon, so the ADCS Connector TLS certificate fails revocation checking. | On the issuing CA in Horizon, set Outdated revocation status policy to Last available status, or open the firewall to the CRLDP host on TCP/80. | +| Connector status: Error and the connector is reported unreachable. | The EverTrust ADCS Connector service is not running on TCP/4443, or a firewall blocks the path between Horizon and the connector host. | Verify the service is running on the connector host, then verify TCP/4443 is open from Horizon. As a quick local check, the connector should answer OK at https://localhost:4443/api/certificate when run on the connector host. | +| Enrollment fails with an authentication error. | The technical account does not have the required ADCS permissions, or the PKCS#12 Enrollment Agent certificate is invalid or expired. | Grant Issue and Manage Certificates on the CA and Read and Enroll on the certificate template to the technical account. Re-export the Enrollment Agent PKCS#12 if its certificate has expired. | +| Enrollment fails with a template-not-found error. | The certificate template name or the CA Config string does not match the live ADCS configuration. | Re-check ADCS_CERTIFICATE_TEMPLATE and ADCS_CA_CONFIG against the ADCS console. The template name is case-sensitive. The CA Config uses a single backslash between CA host and CA name. | +| PKCS#12 credential is rejected during creation. | Wrong passphrase, or the Enrollment Agent certificate has expired. | Re-import the PKCS#12 with the correct passphrase. Confirm the Enrollment Agent certificate is still valid by decoding it locally. | +| Issued certificates are not chained to the expected issuing CA. | A different ADCS CA published a certificate with the same template, or Horizon trusts more than one CA for server authentication. | Decode the issued certificate with decode_x509 and confirm the issuer DN matches the CA recorded in ADCS_CA_CONFIG. | +| Mixing evtadcs and msadcs fields produces validation errors. | The two variants have different required field sets. | Pick one variant in Phase 2 and stick with it. evtadcs requires endPoint, caConfig, profile, domain, loginCredentials, enrollmentCredentials. msadcs requires endPoint, profile, loginCredentials, enrollmentCredentials only. | +| Connector creation succeeds but no certificate appears after submit_request. | Phase 5 ran submit_request without first calling get_request_template, so required fields were missing or empty. | Always call get_request_template before submit_request and fill in every required field returned. | From 097ee3f090100aad8919777342b11950c59c7a78 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 17:05:22 +0200 Subject: [PATCH 6/9] feat: add setup-digicert skill Add the five-file DigiCert CertCentral setup recipe under skills/setup-digicert/ covering both US and EU regions, including optional connector tuning fields. --- scripts/verify-skills.ts | 4 + skills/setup-digicert/SKILL.md | 79 ++++++++++++ skills/setup-digicert/agents/openai.yaml | 15 +++ .../references/prerequisites.yaml | 120 ++++++++++++++++++ skills/setup-digicert/references/recipe.md | 59 +++++++++ .../references/troubleshooting.md | 12 ++ 6 files changed, 289 insertions(+) create mode 100644 skills/setup-digicert/SKILL.md create mode 100644 skills/setup-digicert/agents/openai.yaml create mode 100644 skills/setup-digicert/references/prerequisites.yaml create mode 100644 skills/setup-digicert/references/recipe.md create mode 100644 skills/setup-digicert/references/troubleshooting.md diff --git a/scripts/verify-skills.ts b/scripts/verify-skills.ts index 75e4694..a423d45 100644 --- a/scripts/verify-skills.ts +++ b/scripts/verify-skills.ts @@ -96,6 +96,10 @@ const ALLOWLIST_DENYLIST = new Set([ 'user_references', 'resource_group_references', 'partition_access', + 'digicert_id', + 'digicert_order_id', + 'lifecycle_enroll', + 'lifecycle-enroll', // YAML / placeholder tokens 'true', 'false', diff --git a/skills/setup-digicert/SKILL.md b/skills/setup-digicert/SKILL.md new file mode 100644 index 0000000..05fb719 --- /dev/null +++ b/skills/setup-digicert/SKILL.md @@ -0,0 +1,79 @@ +--- +name: setup-digicert +description: "Walks the user through end-to-end setup of a DigiCert CertCentral integration on a live Horizon CLM instance, asking for every prerequisite up front and verifying state at every step using the horizon MCP tools. Triggers: setup:digicert, /setup-digicert, set up DigiCert, configure DigiCert CertCentral." +when_to_use: "User wants to integrate DigiCert CertCentral with Horizon as a public PKI source, or asks to configure the DigiCert PKI connector." +version: 0.1.0 +requires_mcp: + - horizon +tags: + - setup:digicert + - /setup-digicert + - set up DigiCert + - configure DigiCert CertCentral +--- + +This skill walks the user through configuring a DigiCert CertCentral integration on a live Evertrust Horizon CLM instance. The full procedural recipe lives in `references/recipe.md`. The exhaustive prerequisite list lives in `references/prerequisites.yaml`. Symptom and fix table lives in `references/troubleshooting.md`. Read all three before producing guidance. + +Object names in Horizon are immutable primary keys. Always ask the user for both `name` and `display_name`. All HCQL field names are lowercase. + +## Phase 0 - Preflight (MANDATORY) + +Follow `skills/_shared/preflight-template.md`. For this skill, the required modules check is `webra` in `licensedModules`. The required knowledge resources are `horizon://knowledge/digicert-integration`, `horizon://knowledge/profiles`, and `horizon://knowledge/integrations`. + +If preflight fails on any step, STOP and report the gap to the user. Do not advance. + +## Phase 1 - External MCP / Skill / Knowledge Discovery + +Run the regex `^mcp__.*digicert.*` (case-insensitive) against the names of every MCP tool exposed in the session. Record matching names in `discoveredCapabilities`. + +If a DigiCert MCP is found, mention it to the user and ask whether to use it for any Phase 3 step (organization lookup, domain validation status, API key generation). If no hit, fall back to the embedded recipe in `references/recipe.md`. + +## Phase 2 - Prerequisites (HARD GATE) + +Drive `AskUserQuestion` (or the host equivalent in `skills/_shared/host-primitives.md`) from `references/prerequisites.yaml`. Group the questions in this order: + +1. Region gate: `CERTCENTRAL_REGION`. Once the user picks, set `CERTCENTRAL_BASE_URL` deterministically to the matching URL and confirm before continuing. +2. CertCentral identifiers: `DIGICERT_ORG_ID`, `VALIDATED_DOMAINS`, `DIGICERT_PRODUCT_ID`. +3. Sensitive material: `DIGICERT_API_KEY`. Mark sensitive and never echo back. +4. Horizon object names: `API_TOKEN_CREDENTIAL_NAME`, `API_TOKEN_CREDENTIAL_DISPLAY_NAME`, `DIGICERT_CONNECTOR_NAME`, `DIGICERT_CONNECTOR_DISPLAY_NAME`, `PROFILE_NAME`. +5. Optional connector tuning: `PROXY_URL`, `RETRY_INTERVAL_SECONDS`, `TIMEOUT_SECONDS`, `SKIP_APPROVAL`, `CA_CERT_ID`, `QUEUE_ENABLED`, `CUSTOM_CONNECTOR_DATA_MAPPING`. + +Refuse to advance to Phase 3 until every required value is captured. + +## Phase 3 - External System Setup + +Walk `references/recipe.md` section "External system setup steps" verbatim. After every numbered step, ask "Confirm step complete? (yes/no)". Do not advance on anything but `yes`. Sensitive prerequisites (API key) are never echoed back; print `` instead. + +If `discoveredCapabilities` from Phase 1 includes a DigiCert MCP that can perform a step, propose using it (with the standard mutating-tool confirmation prompt) before falling back to the manual instruction. + +## Phase 4 - Horizon Configuration + +Walk `references/recipe.md` section "Horizon setup steps" verbatim. For each step: + +1. Run the matching read tool to detect existing objects by name (`list_credentials` for credentials, `get_profile` for profiles). For PKI connectors there is currently no MCP read tool; ask the user to confirm from the UI whether the named object already exists. +2. If the object exists, ask `reuse / rename / abort`. +3. If creating a new object, print the exact UI navigation text from the recipe with the resolved values inserted. Sensitive fields print `` not the value. +4. After the user reports the create complete, re-run the read tool and confirm the object is present. + +## Phase 5 - End-to-End Test + +Run the verification calls in `references/recipe.md` section "Verification" in order: + +1. `get_profile` against `PROFILE_NAME`. +2. `get_request_template` against `PROFILE_NAME` with `workflow: enroll`. +3. `submit_request` (mutating, gate behind confirmation) using only the fields returned by step 2 with at least one SAN drawn from `VALIDATED_DOMAINS`. +4. `search_certificates` with the HCQL `metadata.digicert_id exists and profile equals ""`. + +If any step fails, jump to Phase 6. + +## Phase 6 - Troubleshooting + +Use `references/troubleshooting.md` to map symptoms to fixes. + +## Missing MCP Tools + +These tools would automate steps that today require a UI walk: + +- `create_credential`: create the API Token credential without leaving chat. +- `list_pki_connectors`, `get_pki_connector`, `create_pki_connector`: enumerate, fetch, and create the DigiCert PKI connector. +- `create_profile`, `update_profile`: bind the new connector to a profile. diff --git a/skills/setup-digicert/agents/openai.yaml b/skills/setup-digicert/agents/openai.yaml new file mode 100644 index 0000000..03976cf --- /dev/null +++ b/skills/setup-digicert/agents/openai.yaml @@ -0,0 +1,15 @@ +schema: openai-skill-agent/v1 +agent_name: setup-digicert +model: gpt-5 +tools: + - horizon +prompts: + system: ./SKILL.md + references: + - ./references/recipe.md + - ./references/prerequisites.yaml + - ./references/troubleshooting.md +guardrails: + require_user_confirmation_before_mutating: true + require_full_prerequisites_before_walkthrough: true + redact_sensitive_prerequisites: true diff --git a/skills/setup-digicert/references/prerequisites.yaml b/skills/setup-digicert/references/prerequisites.yaml new file mode 100644 index 0000000..866b41c --- /dev/null +++ b/skills/setup-digicert/references/prerequisites.yaml @@ -0,0 +1,120 @@ +schema_version: "1" +prerequisites: + - key: CERTCENTRAL_REGION + description: "DigiCert CertCentral region. US uses https://www.digicert.com. EU uses https://certcentral.digicert.eu. Most accounts are US; the CertCentral console shows CertCentral Europe in the top-left corner if EU." + required: true + sensitive: false + enum: ["US", "EU"] + default: "US" + + - key: CERTCENTRAL_BASE_URL + description: "Base URL of the DigiCert CertCentral API. Derived from CERTCENTRAL_REGION but asked explicitly so the value is recorded for the connector configuration." + required: true + sensitive: false + enum: + - "https://www.digicert.com" + - "https://certcentral.digicert.eu" + + - key: DIGICERT_ORG_ID + description: "Numeric DigiCert organization identifier used during enrollment. Read from CertCentral under Validation > Organizations." + required: true + sensitive: false + validator: "^[0-9]+$" + example: "123456" + + - key: VALIDATED_DOMAINS + description: "Comma-separated list of FQDNs that the connector will be allowed to request certificates for. Every entry MUST already be validated in CertCentral. Domains that are not validated will fail at issuance even if the connector is correct." + required: true + sensitive: false + validator: "^[A-Za-z0-9.,*-]+$" + example: "example.com,api.example.com,*.staging.example.com" + + - key: DIGICERT_PRODUCT_ID + description: "DigiCert product Name ID for the certificate type the connector will issue. Look up at https://dev.digicert.com/certcentral-apis/services-api/glossary.html#product-identifiers" + required: true + sensitive: false + example: "ssl_basic" + + - key: DIGICERT_API_KEY + description: "DigiCert CertCentral API key dedicated to Horizon. Must be associated with a user holding administrative permissions and restricted to Orders. Visible only once at creation; capture it immediately." + required: true + sensitive: true + validator: ".+" + + - key: API_TOKEN_CREDENTIAL_NAME + description: "Immutable name for the Horizon credential that stores the DigiCert API token." + required: true + sensitive: false + example: "digicert-api-token" + + - key: API_TOKEN_CREDENTIAL_DISPLAY_NAME + description: "Human-friendly display name for the API token credential." + required: true + sensitive: false + example: "DigiCert API Token" + + - key: DIGICERT_CONNECTOR_NAME + description: "Immutable name for the new DigiCert PKI connector. Must NOT contain spaces." + required: true + sensitive: false + validator: "^[A-Za-z0-9._-]+$" + example: "digicert-public-tls" + + - key: DIGICERT_CONNECTOR_DISPLAY_NAME + description: "Human-friendly display name for the DigiCert PKI connector." + required: true + sensitive: false + example: "DigiCert Public TLS" + + - key: PROFILE_NAME + description: "Existing Horizon profile to bind to the new connector via pkiConnector. Use __NEW__ to skip binding." + required: true + sensitive: false + default: "__NEW__" + + - key: PROXY_URL + description: "Outbound HTTPS proxy URL if Horizon must use one to reach DigiCert. Empty if direct outbound is available." + required: false + sensitive: false + default: "" + example: "http://proxy.corp.example.com:3128" + + - key: RETRY_INTERVAL_SECONDS + description: "Connector retry interval in seconds for queued DigiCert orders." + required: false + sensitive: false + default: 300 + validator: "^[0-9]+$" + + - key: TIMEOUT_SECONDS + description: "Connector HTTP timeout in seconds when calling the DigiCert API." + required: false + sensitive: false + default: 30 + validator: "^[0-9]+$" + + - key: SKIP_APPROVAL + description: "When true, the connector tells DigiCert to skip CertCentral approvals. Only enable if the CertCentral account is configured for unattended issuance." + required: false + sensitive: false + default: "false" + enum: ["true", "false"] + + - key: CA_CERT_ID + description: "Optional DigiCert intermediate CA identifier when the product permits selecting one." + required: false + sensitive: false + default: "" + + - key: QUEUE_ENABLED + description: "Enable Horizon queueing for DigiCert orders. Recommended true for production." + required: false + sensitive: false + default: "true" + enum: ["true", "false"] + + - key: CUSTOM_CONNECTOR_DATA_MAPPING + description: "Optional JSON string mapping Horizon enrollment fields to DigiCert custom fields. Empty if not used." + required: false + sensitive: false + default: "" diff --git a/skills/setup-digicert/references/recipe.md b/skills/setup-digicert/references/recipe.md new file mode 100644 index 0000000..efd3275 --- /dev/null +++ b/skills/setup-digicert/references/recipe.md @@ -0,0 +1,59 @@ +# DigiCert CertCentral Integration Recipe + +## Architecture summary + +Horizon centralizes certificate requests and lets DigiCert CertCentral act as the public CA. The Horizon DigiCert PKI connector authenticates to CertCentral with an API token and submits orders against a specific organization and product. Issued certificates are returned to Horizon, decorated with the DigiCert order metadata (`digicert_id`, `digicert_order_id`), and exposed through normal Horizon search and lifecycle workflows. + +DigiCert offers two console regions. US accounts talk to `https://www.digicert.com`; EU accounts talk to `https://certcentral.digicert.eu`. The CertCentral console shows the region in the top-left corner; the connector base URL must match. + +DigiCert public issuance requires every requested SAN to be domain-validated on the DigiCert side BEFORE Horizon submits the order. The connector itself does not perform validation; if a domain is missing, CertCentral rejects the order regardless of the Horizon configuration. + +## External system prerequisites + +| Item | Description | +|------|-------------| +| CertCentral account | Active CertCentral subscription with at least one approved organization. | +| Approved organization | Validated in CertCentral, with a numeric organization identifier the connector will use. | +| Pre-validated domains | Every FQDN that Horizon will request must already show valid status under Validation > Domains. | +| DigiCert product | The product (Name ID) the connector targets must be entitled for the account, including the required SAN types. | +| Administrative user | The user who owns the dedicated API key must hold an administrative role; this is mandatory for revocation. | +| Outbound HTTPS | Horizon must reach the DigiCert API endpoint on TCP/443. | + +## Horizon prerequisites + +| Item | Description | +|------|-------------| +| Admin login | Horizon admin with permission to create credentials, PKI connectors, and (optionally) profiles. | +| WebRA module licensed | Required for issuing public certificates through Horizon. | +| Outbound network | Horizon must be able to call CertCentral on TCP/443. If an outbound proxy is required, capture it as PROXY_URL. | + +## External system setup steps + +1. Sign in to CertCentral and confirm the organization the connector will use is in approved state. Read its numeric identifier from Validation > Organizations. +2. Open Validation > Domains and confirm every domain that Horizon will request is in valid status. Check both the apex domain and every SAN entry. +3. Open Automation > API Keys and create a dedicated API key for Horizon. Bind it to a user that holds an administrative role. Set the restriction to Orders. Capture the key value immediately; CertCentral does not show it again. + +## Horizon setup steps + +1. Open Settings > Credentials and create a credential of type API Token. Set name to `API_TOKEN_CREDENTIAL_NAME`, display name to `API_TOKEN_CREDENTIAL_DISPLAY_NAME`. Set Target to PKI Connectors. Paste `DIGICERT_API_KEY` (sensitive). Verify with `list_credentials` filtered by `name_contains: `. +2. Open PKIs > PKI Connectors and create a connector of type DigiCert CertCentral. In the General tab set the connector name to `DIGICERT_CONNECTOR_NAME` (no spaces). Set Proxy to `PROXY_URL` if non-empty. In the Details tab set DigiCert CertCentral API Base URL to `CERTCENTRAL_BASE_URL`, DigiCert CertCentral Product ID to `DIGICERT_PRODUCT_ID`, organization id to `DIGICERT_ORG_ID`, apiCredentials to the credential created in step 1, retryInterval to `RETRY_INTERVAL_SECONDS`, timeout to `TIMEOUT_SECONDS`, skipApproval to `SKIP_APPROVAL`, queue to `QUEUE_ENABLED`, caCertId to `CA_CERT_ID`, customConnectorDataMapping to `CUSTOM_CONNECTOR_DATA_MAPPING`. Save. The MCP server does not currently expose a list tool for PKI connectors; verification at this step is reading the Success status from the UI. +3. If `PROFILE_NAME` is `__NEW__`, create a WebRA profile that references the new connector via `pkiConnector`. Otherwise update the existing profile so its `pkiConnector` field equals `DIGICERT_CONNECTOR_NAME`. Verify with `get_profile`. + +## Verification + +1. `get_profile` against `PROFILE_NAME` confirms `pkiConnector` equals `DIGICERT_CONNECTOR_NAME`. +2. `get_request_template` against `PROFILE_NAME` with `workflow: enroll` returns the enrollment fields required by the chosen product. +3. After explicit user confirmation, run a single test `submit_request` filling only the fields returned by step 2, with at least one SAN drawn from `VALIDATED_DOMAINS`. +4. `search_certificates` with the HCQL `metadata.digicert_id exists and profile equals ""` returns the issued certificate, decorated with `digicert_id` and `digicert_order_id`. + +All HCQL field names are lowercase. The query above uses `metadata.digicert_id` and `profile`, not camelCase variants. + +## Common failure points + +| Symptom | Cause | Fix | +|---------|-------|-----| +| Region mismatch error on save. | US connector pointed at EU base URL or vice versa. | Match `CERTCENTRAL_BASE_URL` to the CertCentral console region. | +| Order rejected because domain not validated. | A SAN was requested before its domain was validated. | Validate the domain in CertCentral first, then re-issue. | +| API authentication errors after key rotation. | Horizon still references the old API key. | Update the API Token credential value; the credential name does not change. | +| `submit_request` payload validation errors. | `get_request_template` was skipped. | Always call `get_request_template` before `submit_request`. | +| Revoke fails with a permissions error. | API key user is not an administrator. | Recreate the API key under an administrator user. | diff --git a/skills/setup-digicert/references/troubleshooting.md b/skills/setup-digicert/references/troubleshooting.md new file mode 100644 index 0000000..c414625 --- /dev/null +++ b/skills/setup-digicert/references/troubleshooting.md @@ -0,0 +1,12 @@ +# DigiCert Setup Troubleshooting + +| Problem | Possible Cause | Solution | +|---------|----------------|----------| +| Connector save fails with an authentication error against the DigiCert API. | Wrong API key, the API key user lacks administrator role, or the API key is missing the Orders restriction. | Re-check the API key by curl-ing CertCentral with it. Regenerate the key if needed. The Orders restriction is mandatory for enrollment requests, and revoking certificates also requires the user to hold an administrative role. | +| Connector save fails with a region error. | The CertCentral account lives in EU but the connector points at the US base URL (or vice versa). | Set CERTCENTRAL_BASE_URL to https://certcentral.digicert.eu for EU accounts or https://www.digicert.com for US. CertCentral displays the region in the top-left corner of its console. | +| Enrollment requests stay queued and never issue. | A requested SAN is not validated on the DigiCert side, or the chosen product does not allow that SAN type. | Open Validation > Domains in CertCentral and confirm every requested FQDN appears with valid status. Confirm DIGICERT_PRODUCT_ID accepts the SAN types in the Horizon enrollment payload. | +| Enrollment fails with an organization mismatch. | DIGICERT_ORG_ID does not match a real or active organization on the DigiCert side. | Read the organization id from Validation > Organizations and update the connector. | +| Connector status reports a network error. | Horizon cannot reach the DigiCert API endpoint over HTTPS. | Confirm outbound TCP/443 to the API endpoint. If a proxy is required, set PROXY_URL on the connector. | +| Issued certificates carry no digicert_id metadata. | The connector was wired to the profile after issuance, or the profile is using a different PKI connector. | Confirm that get_profile returns the DigiCert connector name in pkiConnector for that profile. Re-issue. | +| Revocation fails. | The API key user does not hold an administrative role. | Reissue the API key under a user with administrator permissions. | +| Connector created but enrollment payload missing required fields. | submit_request was called without first calling get_request_template. | Always call get_request_template before submit_request and only fill in fields it returns. | From f33e17b0740a21b86d7c1cfa7a45a1819ef83611 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 17:08:04 +0200 Subject: [PATCH 7/9] feat: add setup-intune skill Add the five-file Microsoft Intune setup recipe under skills/setup-intune/ covering both intune (SCEP) and intunepkcs variants, including the azureTenant rename, the clientauth template backdate requirement, and the Windows-specific SCEP URL caveat. --- skills/setup-intune/SKILL.md | 89 +++++++++ skills/setup-intune/agents/openai.yaml | 15 ++ .../references/prerequisites.yaml | 171 ++++++++++++++++++ skills/setup-intune/references/recipe.md | 70 +++++++ .../references/troubleshooting.md | 14 ++ 5 files changed, 359 insertions(+) create mode 100644 skills/setup-intune/SKILL.md create mode 100644 skills/setup-intune/agents/openai.yaml create mode 100644 skills/setup-intune/references/prerequisites.yaml create mode 100644 skills/setup-intune/references/recipe.md create mode 100644 skills/setup-intune/references/troubleshooting.md diff --git a/skills/setup-intune/SKILL.md b/skills/setup-intune/SKILL.md new file mode 100644 index 0000000..52d303b --- /dev/null +++ b/skills/setup-intune/SKILL.md @@ -0,0 +1,89 @@ +--- +name: setup-intune +description: "Walks the user through end-to-end setup of a Microsoft Intune integration on a live Horizon CLM instance covering both intune (SCEP) and intunepkcs variants, asking for every prerequisite up front and verifying state at every step. Triggers: setup:intune, /setup-intune, set up Intune, configure Intune SCEP, configure Intune PKCS, MDM Intune." +when_to_use: "User wants to integrate Microsoft Intune (SCEP or PKCS) with Horizon to issue certificates to managed devices, or asks to configure the Intune connector and profile." +version: 0.1.0 +requires_mcp: + - horizon +tags: + - setup:intune + - /setup-intune + - set up Intune + - configure Intune SCEP + - configure Intune PKCS + - MDM Intune +--- + +This skill walks the user through configuring a Microsoft Intune integration on a live Evertrust Horizon CLM instance. The full procedural recipe lives in `references/recipe.md`. The exhaustive prerequisite list lives in `references/prerequisites.yaml`. Symptom and fix table lives in `references/troubleshooting.md`. Read all three before producing guidance. + +Object names in Horizon are immutable primary keys. Always ask the user for both `name` and `display_name`. All HCQL field names are lowercase. From Horizon 2.9.0 onward the third-party connector field is `azureTenant`, not `tenant`. + +## Phase 0 - Preflight (MANDATORY) + +Follow `skills/_shared/preflight-template.md`. For this skill, the required modules check is `webra` AND one of `intune` or `intunepkcs` (depending on the variant) in `licensedModules`. The required knowledge resources are `horizon://knowledge/intune-integration`, `horizon://knowledge/integrations`, `horizon://knowledge/automation`, and `horizon://knowledge/profiles`. + +If preflight fails on any step, STOP and report the gap to the user. Do not advance. + +## Phase 1 - External MCP / Skill / Knowledge Discovery + +Run the regex `^mcp__.*(microsoft|graph|entra|azure|m365|intune).*` (case-insensitive) against the names of every MCP tool exposed in the session. Record matching names in `discoveredCapabilities`. + +If a Microsoft Graph, Entra, or Azure MCP is found, mention it to the user and propose using it for any Phase 3 step (App Registration creation, client secret rotation, API permission grant, Trusted certificate profile creation, SCEP profile creation). If no hit, fall back to the embedded recipe. + +## Phase 2 - Prerequisites (HARD GATE) + +Drive `AskUserQuestion` (or the host equivalent) from `references/prerequisites.yaml`. Group the questions in this order: + +1. Variant gate: `INTUNE_VARIANT`. +2. Platform: `TARGET_PLATFORM`. +3. Azure: `TENANT_DIRECTORY_ID`, `APP_REGISTRATION_NAME`, `APP_CLIENT_ID`, `APP_CLIENT_SECRET`, `APP_CLIENT_SECRET_EXPIRY_DATE`, `INTUNE_GROUP`. +4. Trust chain: `ROOT_CA_DER` (path or base64). +5. Underlying PKI: `SCEP_RA_PROFILE_NAME`, `UNDERLYING_PKI_CONNECTOR`, `EXPECTED_EKU`, `TEMPLATE_BACKDATE_MINUTES`. +6. Horizon endpoint: `HORIZON_URL`. +7. Horizon object names: `INTUNE_CONNECTOR_NAME`, `INTUNE_CONNECTOR_DISPLAY_NAME`, `INTUNE_PROFILE_NAME`, `INTUNE_PROFILE_DISPLAY_NAME`, `MDM_CREDENTIAL_NAME`, `MDM_CREDENTIAL_DISPLAY_NAME`, `SCEP_RA_CREDENTIAL_NAME`, `SCEP_RA_CREDENTIAL_DISPLAY_NAME`. +8. Connector tuning: `THROTTLE_DURATION`, `THROTTLE_PARALLELISM`. +9. Variant-conditional: when `INTUNE_VARIANT` is `intune`, ask `LEGACY_REVOCATION_MODE`. When it is `intunepkcs`, ask `PUB_KEY` and `KEY_NAME`. + +Refuse to advance to Phase 3 until every required value is captured. Sensitive prerequisites (`APP_CLIENT_ID`, `APP_CLIENT_SECRET`) are never echoed back; print `` instead. + +## Phase 3 - External System Setup + +Walk `references/recipe.md` section "External system setup steps" verbatim. After every numbered step, ask "Confirm step complete? (yes/no)". Do not advance on anything but `yes`. + +If `discoveredCapabilities` from Phase 1 includes a Microsoft Graph, Entra, or Azure MCP, propose using it (with the standard mutating-tool confirmation prompt) before falling back to the manual instruction. + +## Phase 4 - Horizon Configuration + +Walk `references/recipe.md` section "Horizon setup steps" verbatim. For each step: + +1. Run the matching read tool to detect existing objects by name (`list_credentials` for credentials, `get_profile` for profiles). For PKI connectors, third-party connectors, and certification authorities there is currently no MCP read tool; ask the user to confirm from the UI whether the named object already exists. +2. If the object exists, ask `reuse / rename / abort`. +3. If creating a new object, print the exact UI navigation text from the recipe with the resolved values inserted. Sensitive fields print `` not the value. +4. After the user reports the create complete, re-run the read tool and confirm the object is present. + +The mutating MCP tool used in this skill is `submit_request` (Horizon setup step 2). Gate it behind the confirmation pattern in `skills/_shared/host-primitives.md`. + +## Phase 5 - End-to-End Test + +Run the verification calls in `references/recipe.md` section "Verification" in order: + +1. `get_profile` against `INTUNE_PROFILE_NAME`. +2. `list_credentials` filtered on each credential name. +3. After at least one device has checked in via Company Portal or platform sync, `search_events` with the HCQL `type equals "lifecycle-enroll" and profile equals ""`. +4. Optional `fetch_exposed_certificate` against an enrolled device endpoint when reachable. + +If any step fails, jump to Phase 6. + +## Phase 6 - Troubleshooting + +Use `references/troubleshooting.md` to map symptoms to fixes. + +## Missing MCP Tools + +These tools would automate steps that today require a UI walk: + +- `create_credential`: create both the SCEP RA PKCS#12 credential and the MDM login credential. +- `list_pki_connectors`, `get_pki_connector`, `create_pki_connector`: configure the underlying issuing connector without leaving chat. +- `list_third_party_connectors`, `get_third_party_connector`, `create_third_party_connector`: create the Intune (or Intune PKCS) connector. +- `create_profile`, `update_profile`: create the Horizon Intune profile. +- `import_certificate_chain`: import the root and intermediate CAs in one call. diff --git a/skills/setup-intune/agents/openai.yaml b/skills/setup-intune/agents/openai.yaml new file mode 100644 index 0000000..15a6f7f --- /dev/null +++ b/skills/setup-intune/agents/openai.yaml @@ -0,0 +1,15 @@ +schema: openai-skill-agent/v1 +agent_name: setup-intune +model: gpt-5 +tools: + - horizon +prompts: + system: ./SKILL.md + references: + - ./references/recipe.md + - ./references/prerequisites.yaml + - ./references/troubleshooting.md +guardrails: + require_user_confirmation_before_mutating: true + require_full_prerequisites_before_walkthrough: true + redact_sensitive_prerequisites: true diff --git a/skills/setup-intune/references/prerequisites.yaml b/skills/setup-intune/references/prerequisites.yaml new file mode 100644 index 0000000..49adec0 --- /dev/null +++ b/skills/setup-intune/references/prerequisites.yaml @@ -0,0 +1,171 @@ +schema_version: "1" +prerequisites: + - key: INTUNE_VARIANT + description: "Choose the Intune integration variant. intune uses Intune SCEP (recommended). intunepkcs uses Intune PKCS." + required: true + sensitive: false + enum: ["intune", "intunepkcs"] + default: "intune" + + - key: TARGET_PLATFORM + description: "Device platform that will receive the SCEP or PKCS profile. Pick the primary one for the initial rollout. Other platforms can be added later by repeating Phase 3 step 6." + required: true + sensitive: false + enum: ["Windows", "iOS", "Android", "macOS"] + default: "Windows" + + - key: TENANT_DIRECTORY_ID + description: "Azure tenant Directory (tenant) ID, in UUID form. Read from Microsoft Entra ID > Overview." + required: true + sensitive: false + validator: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$" + + - key: APP_REGISTRATION_NAME + description: "Display name for the new Microsoft Entra App Registration that Horizon will use to talk to Intune." + required: true + sensitive: false + example: "horizon-intune" + + - key: APP_CLIENT_ID + description: "Application (client) ID of the new App Registration, in UUID form. Read from the App Registration overview page after creation." + required: true + sensitive: true + validator: "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$" + + - key: APP_CLIENT_SECRET + description: "Client secret value generated under Certificates & secrets. Visible only once at creation; capture it immediately." + required: true + sensitive: true + validator: ".+" + + - key: APP_CLIENT_SECRET_EXPIRY_DATE + description: "Expiry date of the client secret in ISO 8601 form (YYYY-MM-DD). Used by Horizon to fire an expiry notification before the secret expires." + required: true + sensitive: false + validator: "^[0-9]{4}-[0-9]{2}-[0-9]{2}$" + example: "2027-04-30" + + - key: INTUNE_GROUP + description: "Microsoft Entra group (display name or object ID) that the SCEP / PKCS profile will be assigned to." + required: true + sensitive: false + example: "Corp-Devices-PKI" + + - key: ROOT_CA_DER + description: "DER-encoded root CA file path (and optionally the intermediates path). Both must be importable into Intune as Trusted Certificate profiles. Provide either an absolute file path or a base64 paste; multiple entries comma-separated." + required: true + sensitive: false + + - key: SCEP_RA_PROFILE_NAME + description: "Existing Horizon WebRA profile that issues the SCEP RA TLS-clientAuth certificate. Use __NEW__ to indicate that the skill should walk through creating one before continuing." + required: true + sensitive: false + default: "__NEW__" + + - key: UNDERLYING_PKI_CONNECTOR + description: "Name of the underlying Horizon PKI connector that issues the SCEP RA certificate (typically a Stream-based connector)." + required: true + sensitive: false + example: "stream-internal-tls" + + - key: EXPECTED_EKU + description: "Extended Key Usage that the issued device certificates must carry." + required: false + sensitive: false + default: "clientAuth" + enum: ["clientAuth", "serverAuth", "clientAuth+serverAuth"] + + - key: HORIZON_URL + description: "Externally-reachable Horizon base URL (no trailing slash). Used to compose the SCEP server URL for Intune." + required: true + sensitive: false + validator: "^https://[A-Za-z0-9.-]+(:[0-9]+)?$" + example: "https://clm.example.com" + + - key: INTUNE_CONNECTOR_NAME + description: "Immutable name for the Intune third-party connector in Horizon." + required: true + sensitive: false + example: "intune-default" + + - key: INTUNE_CONNECTOR_DISPLAY_NAME + description: "Human-friendly display name for the Intune connector." + required: true + sensitive: false + example: "Microsoft Intune" + + - key: INTUNE_PROFILE_NAME + description: "Immutable name for the Intune (or Intune PKCS) Horizon profile. Used in the SCEP server URL path." + required: true + sensitive: false + example: "intune-windows-clientauth" + + - key: INTUNE_PROFILE_DISPLAY_NAME + description: "Human-friendly display name for the Intune profile." + required: true + sensitive: false + example: "Intune Windows ClientAuth" + + - key: TEMPLATE_BACKDATE_MINUTES + description: "Backdate (in minutes) on the underlying clientAuth template. The Intune knowledge resource warns that without a backdate of at least 10 minutes, devices re-enroll a fresh certificate at every Intune sync." + required: false + sensitive: false + default: 10 + validator: "^[0-9]+$" + + - key: THROTTLE_DURATION + description: "Connector throttle window in ISO 8601 duration form (for example PT1S, PT5S)." + required: false + sensitive: false + default: "PT1S" + + - key: THROTTLE_PARALLELISM + description: "Maximum parallel calls the connector makes to the Intune side per throttle window." + required: false + sensitive: false + default: 5 + validator: "^[0-9]+$" + + - key: LEGACY_REVOCATION_MODE + description: "Use the legacy revocation API on Intune. Only used by the intune (SCEP) variant. Default false." + required: false + sensitive: false + default: "false" + enum: ["true", "false"] + applies_to: ["intune"] + + - key: PUB_KEY + description: "Public key (PEM body) used to wrap the certificate per the Intune PKCS specification. Required only by intunepkcs." + required: true + sensitive: false + applies_to: ["intunepkcs"] + + - key: KEY_NAME + description: "Name of the wrapping key (Azure Key Vault key name) used to wrap PKCS material. Required only by intunepkcs." + required: true + sensitive: false + applies_to: ["intunepkcs"] + + - key: MDM_CREDENTIAL_NAME + description: "Immutable name for the Horizon credential that stores the Azure App Registration login (client id / client secret) targeting MDM." + required: true + sensitive: false + example: "intune-app-creds" + + - key: MDM_CREDENTIAL_DISPLAY_NAME + description: "Human-friendly display name for the MDM credential." + required: true + sensitive: false + example: "Intune App Registration" + + - key: SCEP_RA_CREDENTIAL_NAME + description: "Immutable name for the Horizon credential that stores the SCEP RA PKCS#12 enrolled in step 2." + required: true + sensitive: false + example: "intune-scep-ra" + + - key: SCEP_RA_CREDENTIAL_DISPLAY_NAME + description: "Human-friendly display name for the SCEP RA credential." + required: true + sensitive: false + example: "Intune SCEP RA" diff --git a/skills/setup-intune/references/recipe.md b/skills/setup-intune/references/recipe.md new file mode 100644 index 0000000..d35e985 --- /dev/null +++ b/skills/setup-intune/references/recipe.md @@ -0,0 +1,70 @@ +# Microsoft Intune Integration Recipe + +## Architecture summary + +Horizon issues device certificates to Intune-managed endpoints by acting as the SCEP authority for an Intune SCEP certificate profile (variant `intune`) or by acting as the PKCS provider (variant `intunepkcs`). In both cases Horizon authenticates to Intune and Microsoft Graph through a dedicated Microsoft Entra App Registration, and Intune validates SCEP challenges by calling Horizon back. + +The SCEP variant flow: the device receives a SCEP profile from Intune, generates a key pair locally, builds a CSR, and sends a SCEP PKCSReq to Horizon. Horizon validates the encrypted Intune challenge with the App Registration credentials, then enrolls the certificate against an underlying PKI connector (typically Stream) and returns the certificate to the device. + +The PKCS variant uses Horizon to wrap the issued PKCS material with a public key managed by Azure Key Vault before pushing it to Intune; the device receives the wrapped material from Intune. + +Both variants require: a third-party Intune connector in Horizon, a PKI connector that points at the underlying issuing CA template, and a Horizon profile that ties the two together. The Horizon 2.9.0 release renamed `tenant` to `azureTenant` on AKV, Intune, and Intune PKCS connectors. + +## External system prerequisites + +| Item | Description | +|------|-------------| +| Microsoft Entra access | Permissions to create an App Registration and a client secret. | +| Intune access | Permissions to create configuration profiles and assign them to a Microsoft Entra group. | +| Microsoft Entra group | Group containing the users or devices that will receive certificates. | +| Trusted CA chain (DER) | Root and every intermediate CA, exported as DER files, ready to upload as Intune Trusted Certificate profiles. | +| Outbound from device | Devices must reach Horizon's external SCEP URL for the SCEP variant. | + +## Horizon prerequisites + +| Item | Description | +|------|-------------| +| WebRA module licensed | Required to enroll the SCEP RA certificate. | +| Intune (or IntunePKCS) module licensed | Required to register and run the third-party connector. | +| Stream (or other) PKI connector | Underlying issuing connector that holds the clientAuth template with the right key usages and backdate. | +| Externally-reachable Horizon URL | Devices reach the SCEP endpoint at https:///intune//pkiclient.exe (drop the trailing /pkiclient.exe for Windows machines and users). | + +## External system setup steps + +1. Microsoft Entra ID > App Registrations > New registration. Name it `APP_REGISTRATION_NAME`. Leave Redirect URI empty. Copy the Application (client) ID into `APP_CLIENT_ID` and the Directory (tenant) ID into `TENANT_DIRECTORY_ID`. +2. App Registration > Certificates & secrets > New client secret. Pick a description and an expiry. Copy the secret value into `APP_CLIENT_SECRET` and record the expiry date in `APP_CLIENT_SECRET_EXPIRY_DATE`. The value is shown only once. +3. App Registration > API permissions > Add a permission > Intune > Application permissions > scep_challenge_provider. Save and grant admin consent. +4. App Registration > API permissions > Add a permission > Microsoft Graph > Application permissions > Application > Application.Read.All. Save and grant admin consent. +5. Intune > Devices > devices > Configuration > Create. Profile = Trusted certificate. Upload one DER file from `ROOT_CA_DER`. For Windows 8.1 and Windows 10/11 also pick Destination Store. Repeat this step for every CA in the chain (root + intermediates + issuing CA). Assign each profile to `INTUNE_GROUP`. +6. Intune > Devices > devices > Configuration > Create. Pick the SCEP Certificates template. Set Certificate validity period, Key Storage Provider (TPM preferred for Windows when available), Key Usages matching the underlying PKI template, Key size matching the Horizon profile, Hash algorithm SHA-2 (never SHA-1). Pick the root CA imported in step 5. Pick Extended Key Usage matching `EXPECTED_EKU`. Set SCEP Server URL to `https:///intune//pkiclient.exe`. For Windows machines or Windows users, REMOVE the trailing `/pkiclient.exe`. Assign to `INTUNE_GROUP`. + +## Horizon setup steps + +1. WebRA SCEP RA profile. Either pick the existing profile named in `SCEP_RA_PROFILE_NAME`, or create a new WebRA profile that targets a Stream PKI Connector with key usages Critical, Digital Signature, Key Encipherment. Verify with `get_profile`. +2. Enroll the SCEP RA TLS-clientAuth PKCS#12. Call `get_request_template` against `SCEP_RA_PROFILE_NAME` with `workflow: enroll`, then `submit_request` (mutating, gate behind confirmation) using only the fields it returned. Download the issued PKCS#12 and its passphrase securely. +3. Settings > Credentials > New > Certificate (PKCS#12) targeting SCEP RA. Set name to `SCEP_RA_CREDENTIAL_NAME`, display name to `SCEP_RA_CREDENTIAL_DISPLAY_NAME`. Upload the PKCS#12 from step 2. Verify with `list_credentials`. +4. Settings > Credentials > New > Login targeting MDM. Set name to `MDM_CREDENTIAL_NAME`, display name to `MDM_CREDENTIAL_DISPLAY_NAME`. Set login to `APP_CLIENT_ID` (sensitive) and password to `APP_CLIENT_SECRET` (sensitive). Optionally set the credential expiration to `APP_CLIENT_SECRET_EXPIRY_DATE` to fire a notification before the secret expires. Verify with `list_credentials`. +5. Configuration > MDM > Intune (or Intune PKCS) > Connectors > New. Set name to `INTUNE_CONNECTOR_NAME`, display name to `INTUNE_CONNECTOR_DISPLAY_NAME`. Set `azureTenant` to `TENANT_DIRECTORY_ID`. Set throttleDuration to `THROTTLE_DURATION`. Set throttleParallelism to `THROTTLE_PARALLELISM`. Set credentials to `MDM_CREDENTIAL_NAME`. For `intune` set legacyRevocationMode to `LEGACY_REVOCATION_MODE`. For `intunepkcs` set pubKey to `PUB_KEY` and keyName to `KEY_NAME`. Save. The MCP server does not currently expose a list tool for third-party connectors; verification at this step is reading the success status from the UI. +6. PKIs > PKI Connectors > New. Configure the underlying connector that will issue the device certificates. The clientAuth template must have key usages digitalSignature and keyEncipherment, EKU `EXPECTED_EKU`, and a backdate of at least `TEMPLATE_BACKDATE_MINUTES` minutes. Without the backdate, devices re-enroll a fresh certificate on every Intune sync. +7. Configuration > MDM > Intune > Profiles > New. Set name to `INTUNE_PROFILE_NAME`, display name to `INTUNE_PROFILE_DISPLAY_NAME`. Wire the Intune connector created in step 5 and the PKI connector created in step 6. Pick the SCEP RA credential created in step 3 as the SCEP Authority (mode RA). Define the certificate-per-holder policy. DO NOT specify a certificate template in this profile (templates are configured upstream on the PKI connector). +8. Trust chain import. Import the root and intermediate CAs into Horizon (Configuration > Certification Authorities) so Horizon trusts the chain when issuing. +9. Copy the generated SCEP server URL `https:///intune//pkiclient.exe` into the Intune SCEP profile created in External setup step 6. Drop the trailing `/pkiclient.exe` for Windows. + +## Verification + +1. `get_profile` against `INTUNE_PROFILE_NAME` returns the new profile with the matching connector references. +2. `list_credentials` filtered by `name_contains: ` and `name_contains: ` returns both credentials. +3. After a device check-in via Company Portal (or MDM sync on the chosen platform), `search_events` with the HCQL `type equals "lifecycle-enroll" and profile equals ""` returns at least one event in the configured window. +4. Optional: `fetch_exposed_certificate` against an enrolled device endpoint, when the device exposes the issued certificate over TLS. + +All HCQL field names are lowercase. The query above uses `type` and `profile`, not camelCase variants. + +## Common failure points + +| Symptom | Cause | Fix | +|---------|-------|-----| +| `tenant` field rejected. | Horizon 2.9.0 or later expects `azureTenant`. | Use `azureTenant` always. | +| Certificates re-enroll at every Intune sync. | Clientauth template lacks the backdate. | Set TEMPLATE_BACKDATE_MINUTES at least 10 on the issuing template. | +| Intune profile rejects creation. | Certificate template was specified inside the Horizon Intune profile. | Clear the template field; the underlying PKI connector defines it. | +| Windows enrollment fails, other platforms succeed. | SCEP URL still has the trailing `/pkiclient.exe` for Windows. | Drop the trailing `/pkiclient.exe` for Windows machines and users. | +| `submit_request` for the SCEP RA fails with missing fields. | `get_request_template` was skipped. | Always call `get_request_template` first. | diff --git a/skills/setup-intune/references/troubleshooting.md b/skills/setup-intune/references/troubleshooting.md new file mode 100644 index 0000000..3d92020 --- /dev/null +++ b/skills/setup-intune/references/troubleshooting.md @@ -0,0 +1,14 @@ +# Intune Setup Troubleshooting + +| Problem | Possible Cause | Solution | +|---------|----------------|----------| +| Intune connector save fails with an unknown azureTenant field. | Horizon is older than 2.9.0 and still uses tenant. | Confirm Horizon version. From 2.9.0 the field is azureTenant for AKV, Intune, and Intune PKCS connectors. Upgrade or fall back to tenant on older Horizon releases. | +| Devices re-enroll a fresh certificate at every Intune sync. | The underlying clientAuth template has no backdate. | Set TEMPLATE_BACKDATE_MINUTES to at least 10 on the issuing template, then update the Horizon profile to point at that template. | +| Devices fail enrollment with a SCEP challenge validation error. | The App Registration is missing scep_challenge_provider on Intune Application permissions. | Open the App Registration > API permissions, add Intune > Application > scep_challenge_provider, then grant admin consent. | +| Devices succeed at challenge validation but Horizon never issues. | The SCEP RA credential references a wrong PKCS#12, or the SCEP RA profile points at the wrong PKI connector. | Confirm SCEP_RA_CREDENTIAL_NAME holds the PKCS#12 enrolled from SCEP_RA_PROFILE_NAME. Confirm the SCEP RA profile points at UNDERLYING_PKI_CONNECTOR. | +| Intune profile creation fails with a certificate template error. | A certificate template was specified in the Horizon Intune profile, but Intune SCEP profiles must not specify one. | Re-open the Horizon profile and clear the certificate template field. | +| SCEP server URL is rejected by Windows machines. | The URL still has a trailing /pkiclient.exe. | For Windows machines and Windows users, drop the trailing /pkiclient.exe in the Intune SCEP profile. | +| Trust chain failures on devices. | One or more CAs in the chain (root or intermediate) were not deployed to Intune as Trusted Certificate profiles. | Repeat Phase 3 step 5 for every CA in the chain. | +| Intune PKCS variant fails on enrollment with a key-wrapping error. | PUB_KEY or KEY_NAME do not match the wrapping key the Intune side expects. | Re-check both values against Azure Key Vault and the Horizon connector configuration. | +| Lifecycle-enroll events never appear after device check-in. | The Microsoft Entra group selected during Intune profile assignment does not include the test device or user. | Confirm the device or user account is in INTUNE_GROUP. | +| Connector save warns about a tenant rename. | Horizon API still references tenant in some places. | Always set azureTenant on current Horizon. Older OpenAPI mentions of tenant are legacy. | From 796ea8ea0a4b4232ad5ce292d8e47fe6fc2d6e29 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 17:11:10 +0200 Subject: [PATCH 8/9] feat: add setup-f5 skill Add the five-file F5 BIG-IP setup recipe under skills/setup-f5/ covering iControl REST role provisioning (with the four required calls verbatim), f5client and f5as3 trigger variants, WebRA scheduled task automation, and BIG-IP discovery via horizon-cli. Tighten verify-skills Outline URL detection to anchor on the http(s) scheme so the rule does not flag self-referential mentions of the Outline domain in shared documentation. --- scripts/verify-skills.ts | 2 +- skills/setup-f5/SKILL.md | 87 +++++++++++++ skills/setup-f5/agents/openai.yaml | 15 +++ skills/setup-f5/references/prerequisites.yaml | 117 ++++++++++++++++++ skills/setup-f5/references/recipe.md | 114 +++++++++++++++++ skills/setup-f5/references/troubleshooting.md | 14 +++ 6 files changed, 348 insertions(+), 1 deletion(-) create mode 100644 skills/setup-f5/SKILL.md create mode 100644 skills/setup-f5/agents/openai.yaml create mode 100644 skills/setup-f5/references/prerequisites.yaml create mode 100644 skills/setup-f5/references/recipe.md create mode 100644 skills/setup-f5/references/troubleshooting.md diff --git a/scripts/verify-skills.ts b/scripts/verify-skills.ts index a423d45..205b420 100644 --- a/scripts/verify-skills.ts +++ b/scripts/verify-skills.ts @@ -453,7 +453,7 @@ function checkNoEmDashesOrPrivateUrls(issues: Issue[]): void { message: 'Em-dash detected. Use a regular dash.', }); } - if (/evertrust\.getoutline\.com/i.test(line)) { + if (/https?:\/\/[^\s)`'"]*evertrust\.getoutline\.com/i.test(line)) { issues.push({ file, line: i + 1, diff --git a/skills/setup-f5/SKILL.md b/skills/setup-f5/SKILL.md new file mode 100644 index 0000000..066e602 --- /dev/null +++ b/skills/setup-f5/SKILL.md @@ -0,0 +1,87 @@ +--- +name: setup-f5 +description: "Walks the user through end-to-end setup of an F5 BIG-IP integration on a live Horizon CLM instance covering iControl REST role provisioning, lifecycle automation triggers, scheduled tasks, and discovery, asking for every prerequisite up front. Triggers: setup:f5, /setup-f5, set up F5, configure F5 BIG-IP, F5 lifecycle automation." +when_to_use: "User wants to integrate an F5 BIG-IP appliance with Horizon for certificate lifecycle automation (push, renew, revoke) and inventory discovery." +version: 0.1.0 +requires_mcp: + - horizon +tags: + - setup:f5 + - /setup-f5 + - set up F5 + - configure F5 BIG-IP + - F5 lifecycle automation +--- + +This skill walks the user through configuring an F5 BIG-IP integration on a live Evertrust Horizon CLM instance. The full procedural recipe lives in `references/recipe.md`. The exhaustive prerequisite list lives in `references/prerequisites.yaml`. Symptom and fix table lives in `references/troubleshooting.md`. Read all three before producing guidance. + +Object names in Horizon are immutable primary keys. Always ask the user for both `name` and `display_name`. All HCQL field names are lowercase. + +## Phase 0 - Preflight (MANDATORY) + +Follow `skills/_shared/preflight-template.md`. For this skill, the required modules check is `webra` in `licensedModules`. The required knowledge resources are `horizon://knowledge/automation`, `horizon://knowledge/discovery-workflows`, `horizon://knowledge/integrations`, `horizon://knowledge/system-admin`, and `horizon://knowledge/datasources`. + +If preflight fails on any step, STOP and report the gap to the user. Do not advance. + +## Phase 1 - External MCP / Skill / Knowledge Discovery + +Run the regex `^mcp__.*(f5|icontrol|bigip|big.?ip).*` (case-insensitive) against the names of every MCP tool exposed in the session. Record matching names in `discoveredCapabilities`. + +If an F5 / iControl MCP is found, mention it to the user and propose using it for the four iControl REST calls in Phase 3 (with the standard mutating-tool confirmation prompt). If no hit, fall back to the embedded recipe. + +## Phase 2 - Prerequisites (HARD GATE) + +Drive `AskUserQuestion` (or the host equivalent) from `references/prerequisites.yaml`. Group the questions in this order: + +1. Variant gate: `F5_TRIGGER_TYPE`. +2. BIG-IP topology: `BIGIP_DNS`, `BIGIP_ADMIN_USER`, `BIGIP_ADMIN_PASSWORD`. Mark the latter two sensitive. +3. Technical account: `TECHNICAL_USER_NAME`, `TECHNICAL_USER_PASSWORD`, `RESOURCE_GROUP_NAME`, `ROLE_NAME`. The password is sensitive. +4. Horizon object names: `F5_CREDENTIAL_NAME`, `F5_CREDENTIAL_DISPLAY_NAME`, `F5_CONNECTOR_NAME`, `F5_CONNECTOR_DISPLAY_NAME`, `F5_TRIGGER_NAME`, `F5_TRIGGER_DISPLAY_NAME`, `PROFILE_NAME`, `SCHEDULED_TASK_NAME`, `SCHEDULED_TASK_CRON`, `DISCOVERY_CAMPAIGN_NAME`, `DISCOVERY_SCOPE`. + +Refuse to advance to Phase 3 until every required value is captured. Sensitive prerequisites are never echoed back; print `` instead. + +## Phase 3 - External System Setup + +Walk `references/recipe.md` section "External system setup steps" verbatim. After every numbered step (1 through 4), ask "Confirm step complete? (yes/no)". Do not advance on anything but `yes`. + +If `discoveredCapabilities` from Phase 1 includes an F5 / iControl MCP, propose using it for each step before falling back to the curl-style instructions embedded in the recipe. + +The four iControl REST calls are described inline in the recipe so the skill never references an external KB. Mask sensitive values (`BIGIP_ADMIN_PASSWORD`, `TECHNICAL_USER_PASSWORD`) in printed argument summaries. + +## Phase 4 - Horizon Configuration + +Walk `references/recipe.md` section "Horizon setup steps" verbatim. For each step: + +1. Run the matching read tool to detect existing objects by name (`list_credentials` for credentials, `list_triggers` for triggers, `get_profile` for profiles). Note: `list_triggers` accepts only `max_items`, `name_contains`, `trigger_type`. There is currently no MCP read tool for third-party connectors or scheduled tasks; ask the user to confirm from the UI whether the named object already exists. +2. If the object exists, ask `reuse / rename / abort`. +3. If creating a new object, print the exact UI navigation text from the recipe with the resolved values inserted. Sensitive fields print `` not the value. +4. After the user reports the create complete, re-run the read tool and confirm the object is present. + +The mutating MCP tool used in this skill is optionally `create_rest_notification` (only for the `f5client` variant when a REST trigger fits). All other writes are UI walks today. Discovery for F5 BIG-IP requires the `horizon-cli netimport bigip` CLI because the `DataSourceType` enum (`dns`, `ldap`, `rest`) does not yet include F5; the skill walks the user through the CLI invocation and flags the missing tool. + +## Phase 5 - End-to-End Test + +Run the verification calls in `references/recipe.md` section "Verification" in order: + +1. `list_credentials` filtered by `name_contains: `. +2. `list_triggers` filtered by `trigger_type: ` and `name_contains: `. +3. `get_profile` against `PROFILE_NAME` and assert `F5_TRIGGER_NAME` is in the relevant `triggerHooks`. +4. `simulate_trigger` against `F5_TRIGGER_NAME`. Read-only, no confirmation gate. +5. After the scheduled task fires and the discovery import completes: `search_discovery_events` with `campaign equals ""`, then `search_certificates` with `discoverydata.paths exists`. + +If any step fails, jump to Phase 6. + +## Phase 6 - Troubleshooting + +Use `references/troubleshooting.md` to map symptoms to fixes. + +## Missing MCP Tools + +These tools would automate steps that today require a UI walk or a CLI invocation: + +- `create_credential`: create the F5 login credential without leaving chat. +- `list_third_party_connectors`, `get_third_party_connector`, `create_third_party_connector`: configure the F5 third-party connector. +- `create_f5client_trigger`, `create_f5as3_trigger`, `attach_trigger_to_profile`: replace the UI step for trigger creation and profile binding. +- `create_scheduled_task`, `list_scheduled_tasks`: replace the WebRA scheduled task UI step. +- `create_f5_datasource`: provide an F5 BIG-IP datasource type so `create_discovery_campaign` can wire BIG-IP discovery without `horizon-cli`. +- `discovery_source_type`: extension to `create_discovery_campaign` accepting non-DNS/LDAP/REST source types. diff --git a/skills/setup-f5/agents/openai.yaml b/skills/setup-f5/agents/openai.yaml new file mode 100644 index 0000000..39a5984 --- /dev/null +++ b/skills/setup-f5/agents/openai.yaml @@ -0,0 +1,15 @@ +schema: openai-skill-agent/v1 +agent_name: setup-f5 +model: gpt-5 +tools: + - horizon +prompts: + system: ./SKILL.md + references: + - ./references/recipe.md + - ./references/prerequisites.yaml + - ./references/troubleshooting.md +guardrails: + require_user_confirmation_before_mutating: true + require_full_prerequisites_before_walkthrough: true + redact_sensitive_prerequisites: true diff --git a/skills/setup-f5/references/prerequisites.yaml b/skills/setup-f5/references/prerequisites.yaml new file mode 100644 index 0000000..8db8bef --- /dev/null +++ b/skills/setup-f5/references/prerequisites.yaml @@ -0,0 +1,117 @@ +schema_version: "1" +prerequisites: + - key: F5_TRIGGER_TYPE + description: "Automation mode for the F5 lifecycle integration. f5client uses iControl REST operational calls (recommended). f5as3 uses AS3 declarative." + required: true + sensitive: false + enum: ["f5client", "f5as3"] + default: "f5client" + + - key: BIGIP_DNS + description: "DNS name (or IP) of the BIG-IP management endpoint. The skill will hit https:///mgmt/* for the iControl REST setup steps." + required: true + sensitive: false + validator: "^[A-Za-z0-9.-]+$" + example: "bigip01.corp.example.com" + + - key: BIGIP_ADMIN_USER + description: "BIG-IP administrator username used to bootstrap the technical account, the role, and the resource group via iControl REST. Used only during Phase 3." + required: true + sensitive: true + + - key: BIGIP_ADMIN_PASSWORD + description: "Password for the BIG-IP administrator account. Used only during Phase 3 bootstrap." + required: true + sensitive: true + validator: ".+" + + - key: TECHNICAL_USER_NAME + description: "Username Horizon will use against BIG-IP for lifecycle operations. Created during Phase 3." + required: false + sensitive: false + default: "horizonCLM" + validator: "^[A-Za-z][A-Za-z0-9_-]*$" + + - key: TECHNICAL_USER_PASSWORD + description: "Password assigned to the BIG-IP technical user during Phase 3." + required: true + sensitive: true + validator: ".{12,}" + + - key: RESOURCE_GROUP_NAME + description: "Name of the iControl REST resource group that grants Horizon the minimum necessary BIG-IP API surface." + required: false + sensitive: false + default: "horizonResourceGroup" + + - key: ROLE_NAME + description: "Name of the iControl REST role that links the technical user to the resource group." + required: false + sensitive: false + default: "horizonCLMrole" + + - key: F5_CREDENTIAL_NAME + description: "Immutable name for the Horizon credential that stores the BIG-IP technical user (login + password). Targeted at third-party connectors." + required: true + sensitive: false + example: "f5-bigip-tech-user" + + - key: F5_CREDENTIAL_DISPLAY_NAME + description: "Human-friendly display name for the F5 credential." + required: true + sensitive: false + example: "F5 BIG-IP Technical User" + + - key: F5_CONNECTOR_NAME + description: "Immutable name for the Horizon F5 third-party connector." + required: true + sensitive: false + example: "f5-bigip-prod" + + - key: F5_CONNECTOR_DISPLAY_NAME + description: "Human-friendly display name for the F5 third-party connector." + required: true + sensitive: false + example: "F5 BIG-IP Production" + + - key: F5_TRIGGER_NAME + description: "Immutable name for the F5 lifecycle trigger that pushes/renews/revokes certificates on the BIG-IP." + required: true + sensitive: false + example: "f5-bigip-prod-trigger" + + - key: F5_TRIGGER_DISPLAY_NAME + description: "Human-friendly display name for the F5 trigger." + required: true + sensitive: false + example: "F5 BIG-IP Production Trigger" + + - key: PROFILE_NAME + description: "Existing Horizon profile to bind the F5 trigger to via triggerHooks." + required: true + sensitive: false + example: "webra-tls-internal" + + - key: SCHEDULED_TASK_NAME + description: "Immutable name for the WebRA scheduled task that drives recurring F5 lifecycle work (typically renewals)." + required: true + sensitive: false + example: "f5-renewals-daily" + + - key: SCHEDULED_TASK_CRON + description: "Cron expression (Quartz format, six fields) for the WebRA scheduled task. Default fires daily at 02:00." + required: false + sensitive: false + default: "0 0 2 * * ?" + + - key: DISCOVERY_CAMPAIGN_NAME + description: "Immutable name for the discovery campaign that ingests the BIG-IP certificate inventory back into Horizon." + required: true + sensitive: false + example: "f5-bigip-inventory" + + - key: DISCOVERY_SCOPE + description: "Scope for the discovery side. Comma-separated list of CIDR ranges or DNS names that Horizon will scan to correlate certificates served by the BIG-IP." + required: true + sensitive: false + example: "10.10.20.0/24,clm-vips.corp.example.com" diff --git a/skills/setup-f5/references/recipe.md b/skills/setup-f5/references/recipe.md new file mode 100644 index 0000000..e2a9da2 --- /dev/null +++ b/skills/setup-f5/references/recipe.md @@ -0,0 +1,114 @@ +# F5 BIG-IP Integration Recipe + +## Architecture summary + +Horizon manages the certificate lifecycle on an F5 BIG-IP appliance by holding a dedicated technical user on the BIG-IP and binding a Horizon trigger (`f5client` for iControl REST or `f5as3` for AS3 declarative) to a Horizon profile. The trigger fires on lifecycle events (issuance, renewal, revocation) and pushes / updates / deletes certificates on the BIG-IP through iControl REST or AS3. + +A WebRA scheduled task drives recurring renewals on the Horizon side. A discovery campaign optionally ingests the BIG-IP certificate inventory back into Horizon so that Horizon's discovery view reconciles with what the BIG-IP actually serves. + +The technical user is created with elevated rights (`resource-admin` on `all-partitions`) so it can perform automatic revocation when a certificate is deleted from the BIG-IP. The user is then removed from the default `iControl_REST_API_User` role and bound to a custom role linked to a resource group that exposes only the nine API method/mask pairs Horizon needs. + +## External system prerequisites + +| Item | Description | +|------|-------------| +| BIG-IP admin access | An administrator account on the BIG-IP, used only during Phase 3 bootstrap. | +| iControl REST reachable | TCP/443 to `https:///mgmt/...` from the host running the iControl calls. | +| Operational platform | A licensed BIG-IP that exposes the LTM client-ssl profile and ssl-cert/ssl-key endpoints (LTM Standard licence). | +| AS3 if f5as3 | When the F5_TRIGGER_TYPE is `f5as3`, the AS3 declarative API package must be installed on the BIG-IP. | + +## Horizon prerequisites + +| Item | Description | +|------|-------------| +| WebRA module licensed | Required to bind the trigger to a profile and run the scheduled task. | +| Outbound to BIG-IP | Horizon must reach the BIG-IP management endpoint over HTTPS. | +| Profile to bind | An existing Horizon profile whose lifecycle events should drive F5 pushes. | + +## External system setup steps + +These four iControl REST calls are sent from any host that can reach the BIG-IP. The skill prints the exact body and expected response after every step. Replace `` with the value collected during Phase 2 and authenticate with `BIGIP_ADMIN_USER` / `BIGIP_ADMIN_PASSWORD`. + +1. POST `https:///mgmt/tm/auth/user` with body: + +```json +{ + "name": "", + "description": "Horizon Technical Account", + "password": "", + "shell": "tmsh", + "partitionAccess": [ + { "name": "all-partitions", "role": "resource-admin" } + ] +} +``` + +Expected response: HTTP 200 with the created user in the body. The skill SHOULD parse the response to confirm the user appears with `partitionAccess` set to `resource-admin` on `all-partitions`. + +2. GET `https:///mgmt/shared/authz/roles/iControl_REST_API_User`. From the returned `userReferences` list, drop the entry whose link references ``. Keep every other entry (typically `admin` and `f5admin`). PUT the modified body back to the same URL. Expected response: HTTP 200 with the updated `userReferences`. + +3. POST `https:///mgmt/shared/authz/resource-groups` with body: + +```json +{ + "name": "", + "resources": [ + {"restMethod": "GET", "resourceMask": "/mgmt/tm/ltm/profile/client-ssl/**"}, + {"restMethod": "GET", "resourceMask": "/mgmt/tm/ltm/profile/client-ssl"}, + {"restMethod": "POST", "resourceMask": "/mgmt/tm/ltm/profile/client-ssl"}, + {"restMethod": "PATCH", "resourceMask": "/mgmt/tm/ltm/profile/client-ssl/**"}, + {"restMethod": "GET", "resourceMask": "/mgmt/tm/sys/file/ssl-cert/**"}, + {"restMethod": "DELETE", "resourceMask": "/mgmt/tm/sys/file/ssl-cert/**"}, + {"restMethod": "DELETE", "resourceMask": "/mgmt/tm/sys/file/ssl-key/**"}, + {"restMethod": "POST", "resourceMask": "/mgmt/shared/file-transfer/uploads/**"}, + {"restMethod": "POST", "resourceMask": "/mgmt/tm/sys/crypto/**"} + ] +} +``` + +Capture the returned `selfLink`. Expected response: HTTP 200. + +4. POST `https:///mgmt/shared/authz/roles` with body: + +```json +{ + "name": "", + "userReferences": [ + {"link": "https://localhost/mgmt/shared/authz/users/"} + ], + "resourceGroupReferences": [ + {"link": ""} + ] +} +``` + +Expected response: HTTP 200 with the role linked to the technical user and the resource group. + +## Horizon setup steps + +1. Settings > Credentials > New > Login (target: third-party connectors). Set name to `F5_CREDENTIAL_NAME`, display name to `F5_CREDENTIAL_DISPLAY_NAME`. Login is `TECHNICAL_USER_NAME`, password is `TECHNICAL_USER_PASSWORD` (sensitive). Verify with `list_credentials` filtered by `name_contains: `. +2. Configuration > Third-Party > F5 > Connectors > New. Set name to `F5_CONNECTOR_NAME`, display name to `F5_CONNECTOR_DISPLAY_NAME`. Wire the BIG-IP endpoint and the credential created in step 1. The MCP server does not currently expose a list tool for third-party connectors; verification is reading the success status from the UI. +3. Configuration > Triggers > New. Variant gate: when `F5_TRIGGER_TYPE` is `f5client` and a REST notification fits the F5 client lifecycle, the skill MAY use `create_rest_notification` (gate behind the standard mutating-tool confirmation). Otherwise create the trigger from the UI. Set name to `F5_TRIGGER_NAME`, display name to `F5_TRIGGER_DISPLAY_NAME`. Verify with `list_triggers` filtered by `trigger_type: ` and `name_contains: `. Note: `list_triggers` accepts only `max_items`, `name_contains`, and `trigger_type` arguments. +4. Bind the trigger to `PROFILE_NAME` via triggerHooks (UI). Verify with `get_profile` that `F5_TRIGGER_NAME` appears in the appropriate `triggerHooks` slot for `PROFILE_NAME`. +5. WebRA Scheduled Task. Create a scheduled task named `SCHEDULED_TASK_NAME` with cron expression `SCHEDULED_TASK_CRON`. The MCP server does not currently expose a create tool for scheduled tasks; flag `create_scheduled_task` as missing. +6. Discovery campaign. The Horizon `DataSourceType` enum currently includes only `dns`, `ldap`, and `rest`; F5 BIG-IP discovery is NOT yet wired into `create_discovery_campaign`. Walk the user through running `horizon-cli netimport bigip` against `BIGIP_DNS` for `DISCOVERY_SCOPE`, as documented in `horizon://knowledge/discovery-workflows`. Flag `create_f5_datasource` and the `discovery_source_type` extension as missing. + +## Verification + +1. `list_credentials` filtered by `name_contains: ` returns the F5 credential. +2. `list_triggers` filtered by `trigger_type: ` and `name_contains: ` returns exactly one trigger. +3. `get_profile` against `PROFILE_NAME` shows `F5_TRIGGER_NAME` in the `triggerHooks` for the relevant lifecycle events. +4. `simulate_trigger` against `F5_TRIGGER_NAME` succeeds. Note that `simulate_trigger` is read-only (executes the trigger with synthetic test context); no confirmation gate is required. +5. After at least one scheduled-task fire and one discovery import, `search_discovery_events` with the HCQL `campaign equals ""` returns events, and `search_certificates` with `discoverydata.paths exists` returns the BIG-IP-served certificates. + +All HCQL field names are lowercase. The query above uses `campaign` and `discoverydata.paths`, not camelCase variants. + +## Common failure points + +| Symptom | Cause | Fix | +|---------|-------|-----| +| Step 4 of the iControl REST setup fails. | The selfLink captured from step 3 was not used verbatim. | Re-read step 3's response and re-issue step 4 with the exact selfLink. | +| Trigger save fails with an unknown enum. | F5_TRIGGER_TYPE not one of `f5client` or `f5as3`. | Pick one of the two enum values. | +| Trigger does not fire. | Not attached to PROFILE_NAME triggerHooks. | Re-open the profile and add F5_TRIGGER_NAME under the right lifecycle event. | +| Discovery returns nothing. | F5 datasource type is not yet supported by create_discovery_campaign. | Run horizon-cli netimport bigip out of band. The skill flags this gap explicitly. | +| simulate_trigger fails. | Stale credentials in F5_CREDENTIAL_NAME. | Update the credential value. | diff --git a/skills/setup-f5/references/troubleshooting.md b/skills/setup-f5/references/troubleshooting.md new file mode 100644 index 0000000..4d6221a --- /dev/null +++ b/skills/setup-f5/references/troubleshooting.md @@ -0,0 +1,14 @@ +# F5 BIG-IP Setup Troubleshooting + +| Problem | Possible Cause | Solution | +|---------|----------------|----------| +| iControl REST step 1 fails with HTTP 401. | The BIG-IP admin credentials used to bootstrap are wrong, or admin login is restricted to a different partition. | Re-check BIGIP_ADMIN_USER and BIGIP_ADMIN_PASSWORD by hitting GET /mgmt/tm/sys/version manually. Confirm the admin account has resource-admin on all-partitions. | +| iControl REST step 4 fails with a missing user link. | The PUT in step 2 wrote the wrong link, or the user reference was not updated correctly. | Reread the role with GET /mgmt/shared/authz/roles/iControl_REST_API_User and re-issue the PUT with the user removed. | +| Lifecycle pushes succeed but certificates do not appear in BIG-IP. | The resource group is missing one of the nine method/mask pairs. | Recreate the resource group exactly with all nine entries: GET, GET wildcard, POST, PATCH wildcard for client-ssl; GET / DELETE wildcard for ssl-cert; DELETE wildcard for ssl-key; POST wildcard for file-transfer/uploads; POST wildcard for sys/crypto. | +| Trigger save fails with an unknown trigger type. | F5_TRIGGER_TYPE was set to a value that does not match the live Horizon enum. | Pick f5client or f5as3 only. f5client uses iControl REST. f5as3 uses AS3 declarative. | +| Trigger fires but no certificate is pushed. | Trigger not bound to the profile triggerHooks, or scheduled task is not running. | Confirm get_profile shows F5_TRIGGER_NAME under triggerHooks for PROFILE_NAME. Confirm SCHEDULED_TASK_NAME exists and last_fired_at is recent. | +| Discovery campaign returns no certificates from BIG-IP. | BIG-IP datasource not configured (the MCP tool create_f5_datasource does not exist yet). | Run horizon-cli netimport bigip out of band as documented in horizon://knowledge/discovery-workflows. The skill never fabricates a missing tool. | +| simulate_trigger reports authentication failure. | F5_CREDENTIAL_NAME stores stale credentials. | Update the credential value (the credential name is immutable) with the current technical user password. | +| iControl REST role removal step leaves the admin or f5admin unreferenced. | The PUT body removed too many users. | Restore admin and f5admin references in the PUT body and re-issue. Only the technical user reference should be removed. | +| Resource group creation reports a missing field. | Body sent without the leading name field or the resources array. | Re-send the POST with the full body including name and the nine method/mask pairs. | +| f5as3 declarative trigger save fails. | The chosen variant is not licensed or not enabled on the Horizon instance. | Confirm the Horizon instance is licensed for f5as3 third-party connectors and triggers. | From 8c33c184ef8d5625400223d07d753cf9e4235291 Mon Sep 17 00:00:00 2001 From: Souf Date: Thu, 30 Apr 2026 17:12:10 +0200 Subject: [PATCH 9/9] chore: relax markdownlint rules for skill recipe formatting --- .markdownlint-cli2.jsonc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.markdownlint-cli2.jsonc b/.markdownlint-cli2.jsonc index 6801cca..5eb9950 100644 --- a/.markdownlint-cli2.jsonc +++ b/.markdownlint-cli2.jsonc @@ -3,7 +3,11 @@ "default": true, "MD013": false, "MD024": { "siblings_only": true }, + "MD029": false, + "MD031": false, "MD033": false, + "MD034": false, + "MD040": false, "MD041": false, "MD046": false },