Amazon Certificate Manager Certificate Manager Operations API

openapi: 3.2.0
info:
  title: AWS Certificate Manager Operations API
  version: '2015-12-08'
  description: Generated from AWS's published Smithy model for AWS Certificate Manager. 9 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://acm.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Operations
paths:
  /#RenewCertificate:
    post:
      operationId: RenewCertificate
      summary: Renew Certificate
      description: Renews an eligible ACM certificate. In order to renew your Amazon Web Services Private CA certificates with ACM, you must first grant the ACM service principal permission to do so. For more information, see Testing Managed Renewal in the ACM User Guide.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: InvalidArnException; RequestInProgressException; ResourceNotFoundException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArnException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.RenewCertificate
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/RenewCertificateRequest'
      tags:
      - Operations
  /#ResendValidationEmail:
    post:
      operationId: ResendValidationEmail
      summary: Resend Validation Email
      description: Resends the email that requests domain ownership validation. The domain owner or an authorized representative must approve the ACM certificate before it can be issued. The certificate can be approved by clicking a link in the mail to navigate to the Amazon certificate approval website and then clicking I Approve. However, the validation email can be blocked by spam filters. Therefore, if you do not receive the original mail, you can request that the mail be resent within 72 hours of requesting the ACM certificate. If more than 72 hours have elapsed since your original request or since your last attempt to resend validation mail, you must request a new certificate. For more information about setting up your contact email addresses, see Configure Email for your Domain.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: InvalidArnException; InvalidDomainValidationOptionsException; InvalidStateException; ResourceNotFoundException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArnException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.ResendValidationEmail
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ResendValidationEmailRequest'
      tags:
      - Operations
  /#GetAccountConfiguration:
    post:
      operationId: GetAccountConfiguration
      summary: Get Account Configuration
      description: Returns the account configuration options associated with an Amazon Web Services account.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/GetAccountConfigurationResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.GetAccountConfiguration
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              type: string
      tags:
      - Operations
  /#PutAccountConfiguration:
    post:
      operationId: PutAccountConfiguration
      summary: Put Account Configuration
      description: Adds or modifies account-level configurations in ACM. The supported configuration option is DaysBeforeExpiry. This option specifies the number of days prior to certificate expiration when ACM starts generating EventBridge events. ACM sends one event per day per certificate until the certificate expires. By default, accounts receive events starting 45 days before certificate expiration.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: ConflictException; ThrottlingException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.PutAccountConfiguration
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/PutAccountConfigurationRequest'
      tags:
      - Operations
  /#GetAcmeExternalAccountBindingCredentials:
    post:
      operationId: GetAcmeExternalAccountBindingCredentials
      summary: Get Acme External Account Binding Credentials
      description: Retrieves the key ID and MAC key credentials for an external account binding. These credentials are used by ACME clients during account registration to bind to the endpoint.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/GetAcmeExternalAccountBindingCredentialsResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '400':
          description: ResourceNotFoundException; ThrottlingException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.GetAcmeExternalAccountBindingCredentials
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/GetAcmeExternalAccountBindingCredentialsRequest'
      tags:
      - Operations
  /#ListCertificateDomainValidations:
    post:
      operationId: ListCertificateDomainValidations
      summary: List Certificate Domain Validations
      description: Returns per-domain validation summaries for an ACM certificate. Each summary includes the domain name, the active validation configuration, and the requested validation configuration when a validation method migration is in progress. You can use the results to monitor the progress of an email-to-DNS validation migration and to retrieve the CNAME records required for DNS validation.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListCertificateDomainValidationsResponse'
        '403':
          description: AccessDeniedException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '400':
          description: InvalidArgsException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InvalidArgsException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.ListCertificateDomainValidations
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListCertificateDomainValidationsRequest'
      tags:
      - Operations
  /#TagResource:
    post:
      operationId: TagResource
      summary: Tag Resource
      description: Adds one or more tags to an ACM resource. Tags are labels that you can use to identify and organize your Amazon Web Services resources. Each tag consists of a key and an optional value. Use this action for all ACM resource types except the certificate resource type. For certificate resources, use AddTagsToCertificate instead. To remove one or more tags, use the UntagResource action. To view all of the tags that have been applied to a resource, use the ListTagsForResource action.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: ResourceNotFoundException; ServiceQuotaExceededException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.TagResource
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/TagResourceRequest'
      tags:
      - Operations
  /#UntagResource:
    post:
      operationId: UntagResource
      summary: Untag Resource
      description: Removes one or more tags from an ACM resource. Use this action for all ACM resource types except the certificate resource type. For certificate resources, use RemoveTagsFromCertificate instead. To add one or more tags, use the TagResource action. To view all of the tags that have been applied to a resource, use the ListTagsForResource action.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: ResourceNotFoundException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.UntagResource
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UntagResourceRequest'
      tags:
      - Operations
  /#UpdateCertificateOptions:
    post:
      operationId: UpdateCertificateOptions
      summary: Update Certificate Options
      description: Updates certificate options. You can use this operation to change the domain validation method or specify whether to export your certificate. For more information, see Migrate from email to DNS validation and Certificate Manager Exportable Managed Certificates.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: ConflictException; InvalidArnException; InvalidStateException; LimitExceededException; ResourceNotFoundException; ValidationException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ConflictException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - CertificateManager.UpdateCertificateOptions
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/UpdateCertificateOptionsRequest'
      tags:
      - Operations
components:
  schemas:
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The key of the tag.
        Value:
          type: string
          description: The value of the tag.
      required:
      - Key
    ResourceNotFoundException:
      type: object
      properties:
        message:
          type: string
    InvalidArgsException:
      type: object
      properties:
        message:
          type: string
    TagResourceRequest:
      type: object
      properties:
        ResourceArn:
          type: string
          description: The ARN of the ACM resource to which the tag is to be applied.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key-value pair that defines the tag to apply.
      required:
      - ResourceArn
      - Tags
    ExpiryEventsConfiguration:
      type: object
      properties:
        DaysBeforeExpiry:
          type: integer
          description: Specifies the number of days prior to certificate expiration when ACM starts generating EventBridge events. ACM sends one event per day per certificate until the certificate expires. By default, accounts receive events starting 45 days before certificate expiration.
    GetAcmeExternalAccountBindingCredentialsRequest:
      type: object
      properties:
        AcmeExternalAccountBindingArn:
          type: string
          description: The Amazon Resource Name (ARN) of the ACME external account binding.
      required:
      - AcmeExternalAccountBindingArn
    InvalidArnException:
      type: object
      properties:
        message:
          type: string
    ValidationChallenge:
      type: object
      properties:
        EmailValidationChallenge:
          $ref: '#/components/schemas/EmailValidationChallenge'
        DnsValidationChallenge:
          $ref: '#/components/schemas/DnsValidationChallenge'
      description: Exactly one member is set.
    PutAccountConfigurationRequest:
      type: object
      properties:
        ExpiryEvents:
          $ref: '#/components/schemas/ExpiryEventsConfiguration'
        IdempotencyToken:
          type: string
          description: Customer-chosen string used to distinguish between calls to PutAccountConfiguration. Idempotency tokens time out after one hour. If you call PutAccountConfiguration multiple times with the same unexpired idempotency token, ACM treats it as the same request and returns the original result. If you change the idempotency token for each call, ACM treats each call as a new request.
      required:
      - IdempotencyToken
    ValidationConfiguration:
      type: object
      properties:
        ValidationMethod:
          type: string
          enum:
          - EMAIL
          - DNS
          - HTTP
          description: 'The validation method for this configuration. Valid values: DNS – Validation using a CNAME record added to your DNS configuration. EMAIL – Validation using an approval email sent to domain contacts. HTTP – Validation using an HTTP resource placed on your web server.'
        ValidationChallenge:
          $ref: '#/components/schemas/ValidationChallenge'
        ValidationStatus:
          type: string
          enum:
          - PENDING_VALIDATION
          - SUCCESS
          - FAILED
          description: 'The validation status for this domain. Valid values: PENDING_VALIDATION – The domain is waiting for validation to complete. SUCCESS – Validation completed successfully. FAILED – Validation failed.'
    GetAccountConfigurationResponse:
      type: object
      properties:
        ExpiryEvents:
          $ref: '#/components/schemas/ExpiryEventsConfiguration'
    ThrottlingException:
      type: object
      properties:
        message:
          type: string
        throttlingReasons:
          type: array
          items:
            $ref: '#/components/schemas/ThrottlingReason'
          description: One or more reasons why the request was throttled.
    ResendValidationEmailRequest:
      type: object
      properties:
        CertificateArn:
          type: string
          description: 'String that contains the ARN of the requested certificate. The certificate ARN is generated and returned by the RequestCertificate action as soon as the request is made. By default, using this parameter causes email to be sent to all top-level domains you specified in the certificate request. The ARN must be of the form: arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012'
        Domain:
          type: string
          description: The fully qualified domain name (FQDN) of the certificate that needs to be validated.
        ValidationDomain:
          type: string
          description: 'The base validation domain that will act as the suffix of the email addresses that are used to send the emails. This must be the same as the Domain value or a superdomain of the Domain value. For example, if you requested a certificate for site.subdomain.example.com and specify a ValidationDomain of subdomain.example.com, ACM sends email to the the following five addresses: admin@subdomain.example.com administrator@subdomain.example.com hostmaster@subdomain.example.com postmaster@subdomain.example.com webmaster@subdomain.example.com'
      required:
      - CertificateArn
      - Domain
      - ValidationDomain
    ConflictException:
      type: object
      properties:
        message:
          type: string
    CertificateOptions:
      type: object
      properties:
        CertificateTransparencyLoggingPreference:
          type: string
          enum:
          - ENABLED
          - DISABLED
          description: This parameter has been deprecated. Certificate transparency logging opt-out is no longer available. All public certificates are recorded in a certificate transparency log.
        Export:
          type: string
          enum:
          - ENABLED
          - DISABLED
          description: You can opt in to allow the export of your certificates by specifying ENABLED. You cannot update the value of Export after the the certificate is created.
        ValidationMethod:
          type: string
          enum:
          - EMAIL
          - DNS
          - HTTP
          description: The domain validation method for the certificate. To migrate from email to DNS validation, specify DNS.
    GetAcmeExternalAccountBindingCredentialsResponse:
      type: object
      properties:
        KeyId:
          type: string
          description: The key identifier for the external account binding credentials.
        MacKey:
          type: string
          description: The MAC key for the external account binding credentials.
    ListCertificateDomainValidationsResponse:
      type: object
      properties:
        DomainValidationSummaryList:
          type: array
          items:
            $ref: '#/components/schemas/DomainValidationSummary'
          description: A list of DomainValidationSummary objects, one for each domain on the certificate. Each object contains the domain name and its active and requested validation configurations.
        NextToken:
          type: string
          description: If the number of results exceeds MaxItems, this token is included in the response. Use this token in a subsequent ListCertificateDomainValidations request to retrieve the next page of results.
    EmailValidationChallenge:
      type: object
      properties:
        ValidationEmails:
          type: array
          items:
            type: string
          description: A list of email addresses that ACM uses to send domain validation emails.
        ValidationDomain:
          type: string
          description: The domain name that ACM uses to send validation emails.
    ListCertificateDomainValidationsRequest:
      type: object
      properties:
        CertificateArn:
          type: string
          description: The Amazon Resource Name (ARN) of the certificate for which to list domain validation summaries.
        NextToken:
          type: string
          description: A token returned by a previous call to ListCertificateDomainValidations. If the number of results exceeds MaxItems, use this token to retrieve the next page of results.
        MaxItems:
          type: integer
          description: The maximum number of domain validation summaries to return. If you don't specify a value, the default is 1000.
      required:
      - CertificateArn
    DnsValidationChallenge:
      type: object
      properties:
        ResourceRecord:
          $ref: '#/components/schemas/ResourceRecord'
    UpdateCertificateOptionsRequest:
      type: object
      properties:
        CertificateArn:
          type: string
          description: 'ARN of the requested certificate to update. This must be of the form: arn:aws:acm:us-east-1:account:certificate/12345678-1234-1234-1234-123456789012'
        Options:
          $ref: '#/components/schemas/CertificateOptions'
      required:
      - CertificateArn
      - Options
    DomainValidationSummary:
      type: object
      properties:
        DomainName:
          type: string
          description: The fully qualified domain name (FQDN) in the certificate for which this validation summary applies.
        ActiveValidationConfiguration:
          $ref: '#/components/schemas/ValidationConfiguration'
        RequestedValidationConfiguration:
          $ref: '#/components/schemas/ValidationConfiguration'
      required:
      - DomainName
    InternalServerException:
      type: object
      properties:
        message:
          type: string
    RenewCertificateRequest:
      type: object
      properties:
        CertificateArn:
          type: string
          description: 'String that contains the ARN of the ACM certificate to be renewed. This must be of the form: arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012 For more information about ARNs, see Amazon Resource Names (ARNs).'
      required:
      - CertificateArn
    UntagResourceRequest:
      type: object
      properties:
        ResourceArn:
          type: string
          description: The ARN of the ACM resource from which the tag is to be removed.
        TagKeys:
          type: array
          items:
            type: string
          description: The key of each tag to remove.
      required:
      - ResourceArn
      - TagKeys
    ResourceRecord:
      type: object
      properties:
        Name:
          type: string
          description: The name of the DNS record to create in your domain. This is supplied by ACM.
        Type:
          type: string
          enum:
          - CNAME
          description: The type of DNS record. Currently this can be CNAME.
        Value:
          type: string
          description: The value of the CNAME record to add to your DNS database. This is supplied by ACM.
      required:
      - Name
      - Type
      - Value
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
    ThrottlingReason:
      type: object
      properties:
        reason:
          type: string
          description: A description of why a request was throttled.
        resource:
          type: string
          description: The resource that causes the request to be throttled.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: acm
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/acm/service/2015-12-08/acm-2015-12-08.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)