Akamai Enrollments API

openapi: 3.2.0
info:
  title: 'Akamai: API Endpoint Definition Access tokens Enrollments API'
  version: '2'
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://{hostname}/api-definitions/v2
tags:
- name: Enrollments
paths:
  /enrollments:
    post:
      description: Creates an enrollment that contains all the information about the process that your certificate goes through from the time you request it, through renewal, and as you obtain subsequent versions.
      operationId: post-enrollment
      summary: Create an enrollment
      tags:
      - Enrollments
      externalDocs:
        description: See documentation for this operation in Akamai's Certificate Provisioning System API
        url: https://techdocs.akamai.com/cps/reference/post-enrollment
      requestBody:
        required: true
        content:
          application/vnd.akamai.cps.enrollment.v11+json:
            example:
              autoRenewalStartTime: null
              certificateChainType: default
              certificateType: third-party
              changeManagement: true
              enableMultiStackedCertificates: false
              id: '10001'
              location: /cps-api/enrollments/10001
              maxAllowedSanNames: 100
              maxAllowedWildcardSanNames: 100
              orgId: '645263546'
              ra: third-party
              signatureAlgorithm: null
              validationType: third-party
              assignedSlots:
              - 1234
              productionSlots:
              - 1234
              stagingSlots:
              - 1234
              adminContact:
                addressLineOne: 150 Broadway
                addressLineTwo: null
                city: Cambridge
                country: US
                email: email@example.com
                firstName: R1
                lastName: D1
                organizationName: Akamai
                phone: 617-555-0111
                postalCode: '02142'
                region: MA
                title: Adminstrator
              csr:
                c: US
                cn: www.example.com
                l: Cambridge
                o: Akamai
                ou: WebEx
                preferredTrustChain: dst-root-ca-x3
                st: MA
                sans:
                - san1.example.com
                - san2.example.com
                - san3.example.com
                - www.example.com
              networkConfiguration:
                geography: core
                mustHaveCiphers: ak-akamai-2020q1
                ocspStapling: 'on'
                preferredCiphers: ak-akamai-2020q1
                quicEnabled: false
                secureNetwork: enhanced-tls
                sniOnly: true
                disallowedTlsVersions:
                - TLSv1
                - TLSv1_1
                clientMutualAuthentication:
                  setId: Custom_CPS-6134b_B-3-1AHBENT.xml
                  authenticationOptions:
                    sendCaListToClient: false
                    ocsp:
                      enabled: false
                dnsNameSettings:
                  cloneDnsNames: false
                  dnsNames:
                  - san2.example.com
                  - san1.example.com
              org:
                addressLineOne: 150 Broadway
                addressLineTwo: null
                city: Cambridge
                country: US
                name: Akamai Technologies
                phone: 617-555-0111
                postalCode: '02142'
                region: MA
              techContact:
                addressLineOne: 150 Broadway
                addressLineTwo: null
                city: Cambridge
                country: US
                email: email@example.com
                firstName: R2
                lastName: D2
                organizationName: Akamai
                phone: 617-555-0111
                postalCode: '02142'
                region: MA
                title: Technical Engineer
              thirdParty:
                excludeSans: false
              pendingChanges:
              - changeType: new-certificate
                location: /cps-api/enrollments/10001/changes/10002
            schema:
              additionalProperties: false
              description: An enrollment displays all the information about the process that your certificate goes through from the time you request it, through renewal, and as you obtain subsequent versions. CPS is a certificate life cycle management tool. Once you obtain a certificate, you use it until it expires, in most cases a year from the date the CA issued the certificate. CPS automatically starts the renewal process 90 days before the old certificate expires. It then automatically deploys the renewed certificate when it receives it from the CA.
              type: object
              required:
              - certificateType
              - changeManagement
              - csr
              - enableMultiStackedCertificates
              - networkConfiguration
              - ra
              - validationType
              properties:
                adminContact:
                  additionalProperties: false
                  description: Contact information for the certificate administrator that you want to use as a contact at your company.
                  type:
                  - object
                  - 'null'
                  properties:
                    addressLineOne:
                      description: The address of your organization.
                      type:
                      - string
                      - 'null'
                    addressLineTwo:
                      description: The address of your organization.
                      type:
                      - string
                      - 'null'
                    city:
                      description: The city where your organization resides.
                      type:
                      - string
                      - 'null'
                    country:
                      description: The country where your organization resides.
                      type:
                      - string
                      - 'null'
                    email:
                      description: The email address of the administrator who you want to use as a contact at your company.
                      type:
                      - string
                      - 'null'
                    firstName:
                      description: The first name of the administrator who you want to use as a contact at your company.
                      type:
                      - string
                      - 'null'
                    lastName:
                      description: The last name of the administrator who you want to use as a contact at your company.
                      type:
                      - string
                      - 'null'
                    organizationName:
                      description: The name of your organization.
                      type:
                      - string
                      - 'null'
                    phone:
                      description: The phone number of your organization.
                      type:
                      - string
                      - 'null'
                    postalCode:
                      description: The postal code of your organization.
                      type:
                      - string
                      - 'null'
                    region:
                      description: The region of your organization, typically a state or province.
                      type:
                      - string
                      - 'null'
                    title:
                      description: The title of the administrator who you want to use as a contact at your company.
                      type:
                      - string
                      - 'null'
                assignedSlots:
                  description: Slots where the certificate either will be deployed or is already deployed.
                  type:
                  - array
                  - 'null'
                  items:
                    type: integer
                autoRenewalStartTime:
                  description: The specific date on which the renewal automatically starts for the enrollment.
                  type:
                  - string
                  - 'null'
                certificateChainType:
                  description: Certificate trust chain type.
                  type:
                  - string
                  - 'null'
                  enum:
                  - default
                  - symantec1kroot
                certificateType:
                  description: Either `san`, `single`, `wildcard`, `wildcard-san`, or `third-party`. See [Enrollment.validationType Values](#validationtype) for details.
                  type: string
                  enum:
                  - san
                  - single
                  - wildcard
                  - wildcard-san
                  - third-party
                changeManagement:
                  description: If you turn change management on for an enrollment, it stops CPS from deploying the certificate to the network until you acknowledge that you are ready to deploy the certificate. You can test the certificate outside of CPS, on the Edge Staging Network (ESN), to make sure it works in your environment and then deploy the certificate. The ESN is a small network of Akamai edge servers built to simulate Akamai's production network to test most of your site or application functionality with current production version configuration options and functions. For more information on the ESN, see the [Edge Staging Network User Guide](https://control.akamai.com/dl/customers/other/EDGESERV/ESN-User-Guide.pdf). You can also contact your account representative with questions or issues with your service on the ESN.
                  type: boolean
                csr:
                  additionalProperties: false
                  description: When you create an enrollment, you also generate a certificate signing request (CSR) using CPS. CPS signs the CSR with the private key. The CSR contains all the information the CA needs to issue your certificate.
                  type: object
                  required:
                  - cn
                  properties:
                    c:
                      description: The country code for the country where your organization is located.
                      type:
                      - string
                      - 'null'
                    cn:
                      description: The common name (CN) you want to use for the certificate in the Common Name field. The domain name you specify here must be owned or have legal rights to use the domain by the company you enter in the Organization field in this tab. The company that owns the domain name must be a legally incorporated entity and be active and in good standing.
                      type: string
                    l:
                      description: Your city in the locality (city).
                      type:
                      - string
                      - 'null'
                    o:
                      description: The name of your company or organization. Enter the name as it appears in all legal documents and as it appears in the legal entity filing.
                      type:
                      - string
                      - 'null'
                    ou:
                      description: Your organizational unit.
                      type:
                      - string
                      - 'null'
                    preferredTrustChain:
                      description: For the Let's Encrypt Domain Validated (DV) SAN certificates, the customer may select one of the trust chain options supported by Let's Encrypt, or not fill out this field. The preferred trust chain will be included by CPS with the leaf certificate in the TLS handshake. If the field does not have a value, whichever trust chain Akamai chooses will be used by default.
                      type:
                      - string
                      - 'null'
                    sans:
                      description: Additional common names (CN) to create a Subject Alternative Names (SAN) list.
                      type:
                      - array
                      - 'null'
                      items:
                        type: string
                    st:
                      description: Your state or province.
                      type:
                      - string
                      - 'null'
                enableMultiStackedCertificates:
                  description: Enable Dual-Stacked certificate deployment for this enrollment.
                  type: boolean
                id:
                  description: The unique identifier of the enrollment.
                  type:
                  - string
                  - 'null'
                location:
                  description: The URI path to the enrollment. The last segment of the URI path serves as a unique identifier for the enrollment.
                  type:
                  - string
                  - 'null'
                maxAllowedSanNames:
                  description: Maximum number of SAN names supported for this enrollment type.
                  type:
                  - integer
                  - 'null'
                maxAllowedWildcardSanNames:
                  description: Maximum number of Wildcard SAN names supported for this enrollment type.
                  type:
                  - integer
                  - 'null'
                networkConfiguration:
                  additionalProperties: false
                  description: Settings that specify any network information and TLS Metadata you want CPS to use to push the completed certificate to the network.
                  type: object
                  required:
                  - geography
                  - quicEnabled
                  - secureNetwork
                  - sniOnly
                  properties:
                    clientMutualAuthentication:
                      additionalProperties: false
                      description: The configuration for client mutual authentication. Specifies  the trust chain that is used to verify client certificates and some configuration  options.
                      type:
                      - object
                      - 'null'
                      properties:
                        authenticationOptions:
                          additionalProperties: false
                          description: Contains the configuration options for the selected trust chain.
                          type:
                          - object
                          - 'null'
                          properties:
                            ocsp:
                              additionalProperties: false
                              description: Whether you want to enable OCSP stapling for client certificates.
                              type:
                              - object
                              - 'null'
                              properties:
                                enabled:
                                  description: Whether the OCSP stapling is enabled.
                                  type:
                                  - boolean
                                  - 'null'
                            sendCaListToClient:
                              description: Whether you want to enable the server to send the certificate authority (CA) list to the client.
                              type:
                              - boolean
                              - 'null'
                        setId:
                          description: The identifier of the set of trust chains, created in the Trust Chain Manager.
                          type:
                          - string
                          - 'null'
                    disallowedTlsVersions:
                      description: Specify the TLS protocol versions you want to disallow.
                      type:
                      - array
                      - 'null'
                      items:
                        type: string
                    dnsNameSettings:
                      additionalProperties: false
                      description: DNS name settings.
                      type:
                      - object
                      - 'null'
                      required:
                      - cloneDnsNames
                      properties:
                        cloneDnsNames:
                          description: Enable if you want CPS to direct traffic using all the SANs listed in the SANs parameter when you created your enrollment.
                          type: boolean
                        dnsNames:
                          description: Names served by SNI-only enabled enrollments.
                          type:
                          - array
                          - 'null'
                          items:
                            type: string
                    geography:
                      description: Use `core` to specify worldwide (includes China and Russia), `china+core` to specify worldwide and  China, and 'russia+core` to specify worldwide and Russia. You can only use this setting to include China and Russia if your Akamai contract specifies your ability to do so and you have approval from the Chinese and Russian government.
                      type: string
                      enum:
                      - core
                      - china+core
                      - russia+core
                    mustHaveCiphers:
                      description: Ciphers that you definitely want to include for your enrollment while deploying it on the network. Defaults to `ak-akamai-default` when it is not set.
                      type:
                      - string
                      - 'null'
                    ocspStapling:
                      description: Enable OCSP stapling for the enrollment. OCSP Stapling improves performance by including a valid OCSP response in every TLS handshake. Specify OCSP Stapling if you want to improve performance by allowing the visitors to your site to query the Online Certificate Status Protocol (OCSP) server at regular intervals to obtain a signed time-stamped OCSP response. This response must be signed by the CA, not the server, therefore ensuring security. Disable OSCP Stapling if you want visitors to your site to contact the CA directly for an OSCP response. OCSP allows you to obtain the revocation status of a certificate. We recommend all customers enable this feature. Use `on`, `off` or `not-set`.
                      type:
                      - string
                      - 'null'
                      enum:
                      - 'on'
                      - 'off'
                      - not-set
                    preferredCiphers:
                      description: Ciphers that you preferably want to include for your enrollment while deploying it on the network. Defaults to `ak-akamai-default` when it is not set.
                      type:
                      - string
                      - 'null'
                    quicEnabled:
                      description: Set to true to enable QUIC protocol.
                      type: boolean
                    secureNetwork:
                      description: Set the type of deployment network you want to use. Set Standard TLS to deploy your certificate to Akamai's standard secure network. It is not PCI compliant. Set Enhanced TLS to deploy your certificate to Akamai's more secure network with PCI compliance capability.
                      type: string
                      enum:
                      - enhanced-tls
                      - standard-tls
                    sniOnly:
                      description: SNI settings for your enrollment. Set to `true` to enable SNI-only for the enrollment. This setting cannot be changed once an enrollment is created.
                      type: boolean
                org:
                  additionalProperties: false
                  description: Your organization information.
                  type:
                  - object
                  - 'null'
                  properties:
                    addressLineOne:
                      description: The address of your organization.
                      type:
                      - string
                      - 'null'
                    addressLineTwo:
                      description: The address of your organization.
                      type:
                      - string
                      - 'null'
                    city:
                      description: The city where your organization resides.
                      type:
                      - string
                      - 'null'
                    country:
                      description: The country where your organization resides.
                      type:
                      - string
                      - 'null'
                    name:
                      description: The name of your organization.
                      type:
                      - string
                      - 'null'
                    phone:
                      description: The phone number of the administrator who you want to use as a contact at your company.
                      type:
                      - string
                      - 'null'
                    postalCode:
                      description: The postal code of your organization.
                      type:
                      - string
                      - 'null'
                    region:
                      description: The region where your organization resides.
                      type:
                      - string
                      - 'null'
                orgId:
                  description: The Digicert unique identifier for the organization. If an orgId value is provided in a PUT or POST request, it is recommended to leave the org, techContact, and adminContact fields null.
                  type:
                  - integer
                  - 'null'
                pendingChanges:
                  description: Returns the Changes currently pending in CPS. The last item in the array is the most recent change.
                  type:
                  - array
                  - 'null'
                  items:
                    additionalProperties: false
                    type: object
                    required:
                    - location
                    properties:
                      changeType:
                        description: Pending change action.
                        type:
                        - string
                        - 'null'
                        enum:
                        - new-certificate
                        - modify-certificate
                        - modify-san
                        - renewal
                      location:
                        description: Location to fetch related change information.
                        type: string
                productionSlots:
                  description: Slots where the certificate is deployed on the production network.
                  type:
                  - array
                  - 'null'
                  items:
                    type: integer
                ra:
                  description: The registration authority or certificate authority (CA) you want to use to obtain a certificate. A CA is a trusted entity that signs certificates and can vouch for the identity of a website. Either `symantec`,  `lets-encrypt`, or `third-party`.
                  type: string
                  enum:
                  - symantec
                  - lets-encrypt
                  - third-party
                signatureAlgorithm:
                  description: The SHA (Secure Hash Algorithm) function. NSA designed this function to produce a hash of certificate contents, which is used in a digital signature.  Specify either `SHA-1` or `SHA-256`. We recommend you use SHA-256.
                  type:
                  - string
                  - 'null'
                  enum:
                  - SHA-1
                  - SHA-256
                stagingSlots:
                  description: Slots where the certificate is deployed on the staging network.
                  type:
                  - array
                  - 'null'
                  items:
                    type: integer
                techContact:
                  additionalProperties: false
                  description: Contact information for an administrator at Akamai.
                  type:
                  - object
                  - 'null'
                  properties:
                    addressLineOne:
                      description: The address for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                    addressLineTwo:
                      description: The address for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                    city:
                      description: The city for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                    country:
                      description: The country for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                    email:
                      description: The email address of the administrator who you want to use as a contact at your company.
                      type:
                      - string
                      - 'null'
                    firstName:
                      description: The first name of the technical contact who you want to use within Akamai. This is the person you work closest with at Akamai who can verify the certificate request. This is the person the CA calls if there are any issues with the certificate and they cannot reach the administrator.
                      type:
                      - string
                      - 'null'
                    lastName:
                      description: The last name of the technical contact who you want to use within Akamai.
                      type:
                      - string
                      - 'null'
                    organizationName:
                      description: The name of your organization in Akamai where your technical contact works.
                      type:
                      - string
                      - 'null'
                    phone:
                      description: The phone number of the technical contact who you want to use within Akamai.
                      type:
                      - string
                      - 'null'
                    postalCode:
                      description: The postal code for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                    region:
                      description: The region for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                    title:
                      description: The title for an administrator at Akamai.
                      type:
                      - string
                      - 'null'
                thirdParty:
                  additionalProperties: false
                  description: Specifies that you want to use a third party certificate. This is any certificate that is not issued through CPS.
                  type:
                  - object
                  - 'null'
                  required:
                  - excludeSans
                  properties:
                    excludeSans:
                      description: If this is true, then the SANs in the enrollment do not appear in the CSR that CPS submits to the CA.
                      type: boolean
                validationType:
                  description: There are three types of validation. Domain Validation (DV), which is the lowest level of validation. The CA validates that you have control of the domain. CPS supports DV certificates issued by Let's Encrypt, a free, automated, and open CA, run for public benefit. Organization Validation (OV), which is the next level of validation. The CA validates that you have control of the domain. Extended Validation (EV), which is the highest level of validation in which you must have signed letters and notaries sent to the CA before signing. You can also specify third party as a type of validation, if you want to use a signed certificate obtained by you from a CA not supported by CPS.  Either `dv`, `ev`, `ov`, or `third-party`.
                  type: string
                  enum:
                  - dv
                  - ev
                  - ov
                  - third-party
              x-akamai:
                file-path: schemas/enrollment.v11.yaml
      responses:
        '202':
          description: Successful response.
          content:
            application/vnd.akamai.cps.enrollment-status.v1+json:
              example:
                enrollment: /cps/v2/enrollments/10002
                changes:
                - /cps/v2/enrollments/10002/changes/10002
              schema:
                additionalProperties: false
                type: object
                required:
                - changes
                - enrollment
                properties:
                  changes:
                    type: array
                    items:
                      type: string
                  enrollment:
                    type: string
                x-akamai:
                  file-path: schemas/enrollment-status.v1.yaml
      parameters:
      - description: Specify the contract on which to operate or view.
        example: '{{contractId}}'
        in: query
        name: contractId
        required: true
        schema:
          example: 1-1TJZH5
          type: string
        x-akamai:
          file-path: parameters/contractId-query.yaml
      - description: Don't deploy after this date (UTC).
        example: '{{deploy-not-after}}'
        in: query
        name: deploy-not-after
        schema:
          example: '2021-01-31'
          type: string
        x-akamai:
          file-path: parameters/deploy-not-after-query.yaml
      - description: Don't deploy before this date (UTC).
        example: '{{deploy-not-before}}'
        in: query
        name: deploy-not-before
        schema:
          example: '2021-01-31'
          type: string
        x-akamai:
          file-path: parameters/deploy-not-before-query.yaml
      - description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
        example: '{{accountSwitchKey}}'
        in: query
        name: accountSwitchKey
        required: false
        schema:
          example: 1-5C0YLB:1-8BYUX
          type: string
    get:
      description: A list of the names of each enrollment.
      operationId: get-enrollments
      summary: List enrollments
      tags:
      - Enrollments
      externalDocs:
        description: See documentation for this operation in Akamai's Certificate Provisioning System API
        url: https://techdocs.akamai.com/cps/reference/get-enrollments
      responses:
        '200':
          description: Success.
          content:
            application/vnd.akamai.cps.enrollments.v11+json:
              example:
                enrollments:
                - autoRenewalStartTime: null
                  certificateChainType: default
                  certificateType: third-party
                  changeManagement: true
                  enableMultiStackedCertificates: false
                  id: '10001'
                  location: /cps-

# --- truncated at 32 KB (160 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/akamai/refs/heads/main/openapi/akamai-enrollments-api-openapi.yml