Akamai Enrollments API

openapi: 3.0.0
info:
  title: 'Akamai: API Endpoint Definition Access tokens Enrollments API'
  version: '2'
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://{hostname}/api-definitions/v2
tags:
- name: Enrollments
paths:
  /enrollments:
    post:
      description: Creates an enrollment that contains all the information about the process that your certificate goes through from the time you request it, through renewal, and as you obtain subsequent versions.
      operationId: post-enrollment
      summary: Create an enrollment
      tags:
      - Enrollments
      externalDocs:
        description: See documentation for this operation in Akamai's Certificate Provisioning System API
        url: https://techdocs.akamai.com/cps/reference/post-enrollment
      requestBody:
        required: true
        content:
          application/vnd.akamai.cps.enrollment.v11+json:
            example:
              autoRenewalStartTime: null
              certificateChainType: default
              certificateType: third-party
              changeManagement: true
              enableMultiStackedCertificates: false
              id: '10001'
              location: /cps-api/enrollments/10001
              maxAllowedSanNames: 100
              maxAllowedWildcardSanNames: 100
              orgId: '645263546'
              ra: third-party
              signatureAlgorithm: null
              validationType: third-party
              assignedSlots:
              - 1234
              productionSlots:
              - 1234
              stagingSlots:
              - 1234
              adminContact:
                addressLineOne: 150 Broadway
                addressLineTwo: null
                city: Cambridge
                country: US
                email: email@example.com
                firstName: R1
                lastName: D1
                organizationName: Akamai
                phone: 617-555-0111
                postalCode: '02142'
                region: MA
                title: Adminstrator
              csr:
                c: US
                cn: www.example.com
                l: Cambridge
                o: Akamai
                ou: WebEx
                preferredTrustChain: dst-root-ca-x3
                st: MA
                sans:
                - san1.example.com
                - san2.example.com
                - san3.example.com
                - www.example.com
              networkConfiguration:
                geography: core
                mustHaveCiphers: ak-akamai-2020q1
                ocspStapling: 'on'
                preferredCiphers: ak-akamai-2020q1
                quicEnabled: false
                secureNetwork: enhanced-tls
                sniOnly: true
                disallowedTlsVersions:
                - TLSv1
                - TLSv1_1
                clientMutualAuthentication:
                  setId: Custom_CPS-6134b_B-3-1AHBENT.xml
                  authenticationOptions:
                    sendCaListToClient: false
                    ocsp:
                      enabled: false
                dnsNameSettings:
                  cloneDnsNames: false
                  dnsNames:
                  - san2.example.com
                  - san1.example.com
              org:
                addressLineOne: 150 Broadway
                addressLineTwo: null
                city: Cambridge
                country: US
                name: Akamai Technologies
                phone: 617-555-0111
                postalCode: '02142'
                region: MA
              techContact:
                addressLineOne: 150 Broadway
                addressLineTwo: null
                city: Cambridge
                country: US
                email: email@example.com
                firstName: R2
                lastName: D2
                organizationName: Akamai
                phone: 617-555-0111
                postalCode: '02142'
                region: MA
                title: Technical Engineer
              thirdParty:
                excludeSans: false
              pendingChanges:
              - changeType: new-certificate
                location: /cps-api/enrollments/10001/changes/10002
            schema:
              additionalProperties: false
              description: An enrollment displays all the information about the process that your certificate goes through from the time you request it, through renewal, and as you obtain subsequent versions. CPS is a certificate life cycle management tool. Once you obtain a certificate, you use it until it expires, in most cases a year from the date the CA issued the certificate. CPS automatically starts the renewal process 90 days before the old certificate expires. It then automatically deploys the renewed certificate when it receives it from the CA.
              type: object
              required:
              - certificateType
              - changeManagement
              - csr
              - enableMultiStackedCertificates
              - networkConfiguration
              - ra
              - validationType
              properties:
                adminContact:
                  additionalProperties: false
                  description: Contact information for the certificate administrator that you want to use as a contact at your company.
                  nullable: true
                  type: object
                  properties:
                    addressLineOne:
                      description: The address of your organization.
                      nullable: true
                      type: string
                    addressLineTwo:
                      description: The address of your organization.
                      nullable: true
                      type: string
                    city:
                      description: The city where your organization resides.
                      nullable: true
                      type: string
                    country:
                      description: The country where your organization resides.
                      nullable: true
                      type: string
                    email:
                      description: The email address of the administrator who you want to use as a contact at your company.
                      nullable: true
                      type: string
                    firstName:
                      description: The first name of the administrator who you want to use as a contact at your company.
                      nullable: true
                      type: string
                    lastName:
                      description: The last name of the administrator who you want to use as a contact at your company.
                      nullable: true
                      type: string
                    organizationName:
                      description: The name of your organization.
                      nullable: true
                      type: string
                    phone:
                      description: The phone number of your organization.
                      nullable: true
                      type: string
                    postalCode:
                      description: The postal code of your organization.
                      nullable: true
                      type: string
                    region:
                      description: The region of your organization, typically a state or province.
                      nullable: true
                      type: string
                    title:
                      description: The title of the administrator who you want to use as a contact at your company.
                      nullable: true
                      type: string
                assignedSlots:
                  description: Slots where the certificate either will be deployed or is already deployed.
                  nullable: true
                  type: array
                  items:
                    type: integer
                autoRenewalStartTime:
                  description: The specific date on which the renewal automatically starts for the enrollment.
                  nullable: true
                  type: string
                certificateChainType:
                  description: Certificate trust chain type.
                  nullable: true
                  type: string
                  enum:
                  - default
                  - symantec1kroot
                certificateType:
                  description: Either `san`, `single`, `wildcard`, `wildcard-san`, or `third-party`. See [Enrollment.validationType Values](#validationtype) for details.
                  type: string
                  enum:
                  - san
                  - single
                  - wildcard
                  - wildcard-san
                  - third-party
                changeManagement:
                  description: If you turn change management on for an enrollment, it stops CPS from deploying the certificate to the network until you acknowledge that you are ready to deploy the certificate. You can test the certificate outside of CPS, on the Edge Staging Network (ESN), to make sure it works in your environment and then deploy the certificate. The ESN is a small network of Akamai edge servers built to simulate Akamai's production network to test most of your site or application functionality with current production version configuration options and functions. For more information on the ESN, see the [Edge Staging Network User Guide](https://control.akamai.com/dl/customers/other/EDGESERV/ESN-User-Guide.pdf). You can also contact your account representative with questions or issues with your service on the ESN.
                  type: boolean
                csr:
                  additionalProperties: false
                  description: When you create an enrollment, you also generate a certificate signing request (CSR) using CPS. CPS signs the CSR with the private key. The CSR contains all the information the CA needs to issue your certificate.
                  type: object
                  required:
                  - cn
                  properties:
                    c:
                      description: The country code for the country where your organization is located.
                      nullable: true
                      type: string
                    cn:
                      description: The common name (CN) you want to use for the certificate in the Common Name field. The domain name you specify here must be owned or have legal rights to use the domain by the company you enter in the Organization field in this tab. The company that owns the domain name must be a legally incorporated entity and be active and in good standing.
                      type: string
                    l:
                      description: Your city in the locality (city).
                      nullable: true
                      type: string
                    o:
                      description: The name of your company or organization. Enter the name as it appears in all legal documents and as it appears in the legal entity filing.
                      nullable: true
                      type: string
                    ou:
                      description: Your organizational unit.
                      nullable: true
                      type: string
                    preferredTrustChain:
                      description: For the Let's Encrypt Domain Validated (DV) SAN certificates, the customer may select one of the trust chain options supported by Let's Encrypt, or not fill out this field. The preferred trust chain will be included by CPS with the leaf certificate in the TLS handshake. If the field does not have a value, whichever trust chain Akamai chooses will be used by default.
                      nullable: true
                      type: string
                    sans:
                      description: Additional common names (CN) to create a Subject Alternative Names (SAN) list.
                      nullable: true
                      type: array
                      items:
                        type: string
                    st:
                      description: Your state or province.
                      nullable: true
                      type: string
                enableMultiStackedCertificates:
                  description: Enable Dual-Stacked certificate deployment for this enrollment.
                  type: boolean
                id:
                  description: The unique identifier of the enrollment.
                  nullable: true
                  type: string
                location:
                  description: The URI path to the enrollment. The last segment of the URI path serves as a unique identifier for the enrollment.
                  nullable: true
                  type: string
                maxAllowedSanNames:
                  description: Maximum number of SAN names supported for this enrollment type.
                  nullable: true
                  type: integer
                maxAllowedWildcardSanNames:
                  description: Maximum number of Wildcard SAN names supported for this enrollment type.
                  nullable: true
                  type: integer
                networkConfiguration:
                  additionalProperties: false
                  description: Settings that specify any network information and TLS Metadata you want CPS to use to push the completed certificate to the network.
                  type: object
                  required:
                  - geography
                  - quicEnabled
                  - secureNetwork
                  - sniOnly
                  properties:
                    clientMutualAuthentication:
                      additionalProperties: false
                      description: The configuration for client mutual authentication. Specifies  the trust chain that is used to verify client certificates and some configuration  options.
                      nullable: true
                      type: object
                      properties:
                        authenticationOptions:
                          additionalProperties: false
                          description: Contains the configuration options for the selected trust chain.
                          nullable: true
                          type: object
                          properties:
                            ocsp:
                              additionalProperties: false
                              description: Whether you want to enable OCSP stapling for client certificates.
                              nullable: true
                              type: object
                              properties:
                                enabled:
                                  description: Whether the OCSP stapling is enabled.
                                  nullable: true
                                  type: boolean
                            sendCaListToClient:
                              description: Whether you want to enable the server to send the certificate authority (CA) list to the client.
                              nullable: true
                              type: boolean
                        setId:
                          description: The identifier of the set of trust chains, created in the Trust Chain Manager.
                          nullable: true
                          type: string
                    disallowedTlsVersions:
                      description: Specify the TLS protocol versions you want to disallow.
                      nullable: true
                      type: array
                      items:
                        type: string
                    dnsNameSettings:
                      additionalProperties: false
                      description: DNS name settings.
                      nullable: true
                      type: object
                      required:
                      - cloneDnsNames
                      properties:
                        cloneDnsNames:
                          description: Enable if you want CPS to direct traffic using all the SANs listed in the SANs parameter when you created your enrollment.
                          type: boolean
                        dnsNames:
                          description: Names served by SNI-only enabled enrollments.
                          nullable: true
                          type: array
                          items:
                            type: string
                    geography:
                      description: Use `core` to specify worldwide (includes China and Russia), `china+core` to specify worldwide and  China, and 'russia+core` to specify worldwide and Russia. You can only use this setting to include China and Russia if your Akamai contract specifies your ability to do so and you have approval from the Chinese and Russian government.
                      type: string
                      enum:
                      - core
                      - china+core
                      - russia+core
                    mustHaveCiphers:
                      description: Ciphers that you definitely want to include for your enrollment while deploying it on the network. Defaults to `ak-akamai-default` when it is not set.
                      nullable: true
                      type: string
                    ocspStapling:
                      description: Enable OCSP stapling for the enrollment. OCSP Stapling improves performance by including a valid OCSP response in every TLS handshake. Specify OCSP Stapling if you want to improve performance by allowing the visitors to your site to query the Online Certificate Status Protocol (OCSP) server at regular intervals to obtain a signed time-stamped OCSP response. This response must be signed by the CA, not the server, therefore ensuring security. Disable OSCP Stapling if you want visitors to your site to contact the CA directly for an OSCP response. OCSP allows you to obtain the revocation status of a certificate. We recommend all customers enable this feature. Use `on`, `off` or `not-set`.
                      nullable: true
                      type: string
                      enum:
                      - 'on'
                      - 'off'
                      - not-set
                    preferredCiphers:
                      description: Ciphers that you preferably want to include for your enrollment while deploying it on the network. Defaults to `ak-akamai-default` when it is not set.
                      nullable: true
                      type: string
                    quicEnabled:
                      description: Set to true to enable QUIC protocol.
                      type: boolean
                    secureNetwork:
                      description: Set the type of deployment network you want to use. Set Standard TLS to deploy your certificate to Akamai's standard secure network. It is not PCI compliant. Set Enhanced TLS to deploy your certificate to Akamai's more secure network with PCI compliance capability.
                      type: string
                      enum:
                      - enhanced-tls
                      - standard-tls
                    sniOnly:
                      description: SNI settings for your enrollment. Set to `true` to enable SNI-only for the enrollment. This setting cannot be changed once an enrollment is created.
                      type: boolean
                org:
                  additionalProperties: false
                  description: Your organization information.
                  nullable: true
                  type: object
                  properties:
                    addressLineOne:
                      description: The address of your organization.
                      nullable: true
                      type: string
                    addressLineTwo:
                      description: The address of your organization.
                      nullable: true
                      type: string
                    city:
                      description: The city where your organization resides.
                      nullable: true
                      type: string
                    country:
                      description: The country where your organization resides.
                      nullable: true
                      type: string
                    name:
                      description: The name of your organization.
                      nullable: true
                      type: string
                    phone:
                      description: The phone number of the administrator who you want to use as a contact at your company.
                      nullable: true
                      type: string
                    postalCode:
                      description: The postal code of your organization.
                      nullable: true
                      type: string
                    region:
                      description: The region where your organization resides.
                      nullable: true
                      type: string
                orgId:
                  description: The Digicert unique identifier for the organization. If an orgId value is provided in a PUT or POST request, it is recommended to leave the org, techContact, and adminContact fields null.
                  nullable: true
                  type: integer
                pendingChanges:
                  description: Returns the Changes currently pending in CPS. The last item in the array is the most recent change.
                  nullable: true
                  type: array
                  items:
                    additionalProperties: false
                    type: object
                    required:
                    - location
                    properties:
                      changeType:
                        description: Pending change action.
                        nullable: true
                        type: string
                        enum:
                        - new-certificate
                        - modify-certificate
                        - modify-san
                        - renewal
                      location:
                        description: Location to fetch related change information.
                        type: string
                productionSlots:
                  description: Slots where the certificate is deployed on the production network.
                  nullable: true
                  type: array
                  items:
                    type: integer
                ra:
                  description: The registration authority or certificate authority (CA) you want to use to obtain a certificate. A CA is a trusted entity that signs certificates and can vouch for the identity of a website. Either `symantec`,  `lets-encrypt`, or `third-party`.
                  type: string
                  enum:
                  - symantec
                  - lets-encrypt
                  - third-party
                signatureAlgorithm:
                  description: The SHA (Secure Hash Algorithm) function. NSA designed this function to produce a hash of certificate contents, which is used in a digital signature.  Specify either `SHA-1` or `SHA-256`. We recommend you use SHA-256.
                  nullable: true
                  type: string
                  enum:
                  - SHA-1
                  - SHA-256
                stagingSlots:
                  description: Slots where the certificate is deployed on the staging network.
                  nullable: true
                  type: array
                  items:
                    type: integer
                techContact:
                  additionalProperties: false
                  description: Contact information for an administrator at Akamai.
                  nullable: true
                  type: object
                  properties:
                    addressLineOne:
                      description: The address for an administrator at Akamai.
                      nullable: true
                      type: string
                    addressLineTwo:
                      description: The address for an administrator at Akamai.
                      nullable: true
                      type: string
                    city:
                      description: The city for an administrator at Akamai.
                      nullable: true
                      type: string
                    country:
                      description: The country for an administrator at Akamai.
                      nullable: true
                      type: string
                    email:
                      description: The email address of the administrator who you want to use as a contact at your company.
                      nullable: true
                      type: string
                    firstName:
                      description: The first name of the technical contact who you want to use within Akamai. This is the person you work closest with at Akamai who can verify the certificate request. This is the person the CA calls if there are any issues with the certificate and they cannot reach the administrator.
                      nullable: true
                      type: string
                    lastName:
                      description: The last name of the technical contact who you want to use within Akamai.
                      nullable: true
                      type: string
                    organizationName:
                      description: The name of your organization in Akamai where your technical contact works.
                      nullable: true
                      type: string
                    phone:
                      description: The phone number of the technical contact who you want to use within Akamai.
                      nullable: true
                      type: string
                    postalCode:
                      description: The postal code for an administrator at Akamai.
                      nullable: true
                      type: string
                    region:
                      description: The region for an administrator at Akamai.
                      nullable: true
                      type: string
                    title:
                      description: The title for an administrator at Akamai.
                      nullable: true
                      type: string
                thirdParty:
                  additionalProperties: false
                  description: Specifies that you want to use a third party certificate. This is any certificate that is not issued through CPS.
                  nullable: true
                  type: object
                  required:
                  - excludeSans
                  properties:
                    excludeSans:
                      description: If this is true, then the SANs in the enrollment do not appear in the CSR that CPS submits to the CA.
                      type: boolean
                validationType:
                  description: There are three types of validation. Domain Validation (DV), which is the lowest level of validation. The CA validates that you have control of the domain. CPS supports DV certificates issued by Let's Encrypt, a free, automated, and open CA, run for public benefit. Organization Validation (OV), which is the next level of validation. The CA validates that you have control of the domain. Extended Validation (EV), which is the highest level of validation in which you must have signed letters and notaries sent to the CA before signing. You can also specify third party as a type of validation, if you want to use a signed certificate obtained by you from a CA not supported by CPS.  Either `dv`, `ev`, `ov`, or `third-party`.
                  type: string
                  enum:
                  - dv
                  - ev
                  - ov
                  - third-party
              x-akamai:
                file-path: schemas/enrollment.v11.yaml
      responses:
        '202':
          description: Successful response.
          content:
            application/vnd.akamai.cps.enrollment-status.v1+json:
              example:
                enrollment: /cps/v2/enrollments/10002
                changes:
                - /cps/v2/enrollments/10002/changes/10002
              schema:
                additionalProperties: false
                type: object
                required:
                - changes
                - enrollment
                properties:
                  changes:
                    type: array
                    items:
                      type: string
                  enrollment:
                    type: string
                x-akamai:
                  file-path: schemas/enrollment-status.v1.yaml
      parameters:
      - description: Specify the contract on which to operate or view.
        example: '{{contractId}}'
        in: query
        name: contractId
        required: true
        schema:
          example: 1-1TJZH5
          type: string
        x-akamai:
          file-path: parameters/contractId-query.yaml
      - description: Don't deploy after this date (UTC).
        example: '{{deploy-not-after}}'
        in: query
        name: deploy-not-after
        schema:
          example: '2021-01-31'
          type: string
        x-akamai:
          file-path: parameters/deploy-not-after-query.yaml
      - description: Don't deploy before this date (UTC).
        example: '{{deploy-not-before}}'
        in: query
        name: deploy-not-before
        schema:
          example: '2021-01-31'
          type: string
        x-akamai:
          file-path: parameters/deploy-not-before-query.yaml
      - description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
        example: '{{accountSwitchKey}}'
        in: query
        name: accountSwitchKey
        required: false
        schema:
          example: 1-5C0YLB:1-8BYUX
          type: string
    get:
      description: A list of the names of each enrollment.
      operationId: get-enrollments
      summary: List enrollments
      tags:
      - Enrollments
      externalDocs:
        description: See documentation for this operation in Akamai's Certificate Provisioning System API
        url: https://techdocs.akamai.com/cps/reference/get-enrollments
      responses:
        '200':
          description: Success.
          content:
            application/vnd.akamai.cps.enrollments.v11+json:
              example:
                enrollments:
                - autoRenewalStartTime: null
                  certificateChainType: default
                  certificateType: third-party
                  changeManagement: true
                  enableMultiStackedCertificates: false
                  id: '10001'
                  location: /cps-api/enrollments/10001
                  maxAllowedSanNames: 100
                  maxAllowedWildcardSanNames: 100
                  orgId: '645263546'
                  ra: third-party
                  signatureAlgorithm: null
                  validationType: third-party
                  assignedSlots:
                  - 1234
                  slots:
                  - 1234
                  stagingSlots:
                  - 1234
                  adminContact:
                    addressLineOne: 150 Broadway
                    addressLineTwo: null
                    city: Cambridge
                    country: US
                    email: email@example.com
                    firstName: R1
                    lastName: D1
                    organizationName: Akamai
                    phone: 617-555-0111
                    postalCode: '02142'
                    region: MA
                    title: Adminstrator
                  csr:
                    c: US
                    cn: www.example.com
                    l: Cambridge
                    o: Akamai
                    ou: WebEx
                    preferredTrustChain: dst-root-ca-x3
                    st: MA


# --- truncated at 32 KB (155 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/akamai/refs/heads/main/openapi/akamai-enrollments-api-openapi.yml