Amazon Private CA Private Ca Accesscontrolentries API

openapi: 3.1.0
info:
  title: AWS Certificate Manager Private Certificate Authority Accesscontrolentries API
  version: '2017-08-22'
  description: Generated from AWS's published Smithy model for AWS Certificate Manager Private Certificate Authority. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://pca-connector-ad.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /templates/{TemplateArn}/accessControlEntries:
    post:
      operationId: CreateTemplateGroupAccessControlEntry
      summary: Create Template Group Access Control Entry
      description: Create a group access control entry. Allow or deny Active Directory groups from enrolling and/or autoenrolling
        with the template based on the group security identifiers (SIDs).
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '402':
          description: ServiceQuotaExceededException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceQuotaExceededException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTemplateGroupAccessControlEntryRequest'
      tags:
      - Accesscontrolentries
    get:
      operationId: ListTemplateGroupAccessControlEntries
      summary: List Template Group Access Control Entries
      description: Lists group access control entries you created.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTemplateGroupAccessControlEntriesResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListTemplateGroupAccessControlEntriesRequest'
      tags:
      - Accesscontrolentries
  /templates/{TemplateArn}/accessControlEntries/{GroupSecurityIdentifier}:
    get:
      operationId: GetTemplateGroupAccessControlEntry
      summary: Get Template Group Access Control Entry
      description: Retrieves the group access control entries for a template.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTemplateGroupAccessControlEntryResponse'
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetTemplateGroupAccessControlEntryRequest'
      tags:
      - Accesscontrolentries
    patch:
      operationId: UpdateTemplateGroupAccessControlEntry
      summary: Update Template Group Access Control Entry
      description: Update a group access control entry you created using CreateTemplateGroupAccessControlEntry.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTemplateGroupAccessControlEntryRequest'
      tags:
      - Accesscontrolentries
    delete:
      operationId: DeleteTemplateGroupAccessControlEntry
      summary: Delete Template Group Access Control Entry
      description: Deletes a group access control entry.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: string
        '403':
          description: AccessDeniedException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessDeniedException'
        '409':
          description: ConflictException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictException'
        '500':
          description: InternalServerException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerException'
        '404':
          description: ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceNotFoundException'
        '429':
          description: ThrottlingException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThrottlingException'
        '400':
          description: ValidationException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteTemplateGroupAccessControlEntryRequest'
      tags:
      - Accesscontrolentries
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: pca-connector-ad
  schemas:
    AccessControlEntry:
      type: object
      properties:
        GroupDisplayName:
          type: string
          description: Name of the Active Directory group. This name does not need to match the group name in Active Directory.
        GroupSecurityIdentifier:
          type: string
          description: Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
        AccessRights:
          $ref: '#/components/schemas/AccessRights'
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
        CreatedAt:
          type: string
          description: The date and time that the Access Control Entry was created.
        UpdatedAt:
          type: string
          description: The date and time that the Access Control Entry was updated.
    AccessControlEntrySummary:
      type: object
      properties:
        GroupDisplayName:
          type: string
          description: Name of the Active Directory group. This name does not need to match the group name in Active Directory.
        GroupSecurityIdentifier:
          type: string
          description: Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
        AccessRights:
          $ref: '#/components/schemas/AccessRights'
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
        CreatedAt:
          type: string
          description: The date and time that the Access Control Entry was created.
        UpdatedAt:
          type: string
          description: The date and time that the Access Control Entry was updated.
    AccessDeniedException:
      type: object
      properties:
        Message:
          type: string
      required:
      - Message
    AccessRights:
      type: object
      properties:
        Enroll:
          type: string
          enum:
          - ALLOW
          - DENY
          description: Allow or deny an Active Directory group from enrolling certificates issued against a template.
        AutoEnroll:
          type: string
          enum:
          - ALLOW
          - DENY
          description: Allow or deny an Active Directory group from autoenrolling certificates issued against a template.
            The Active Directory group must be allowed to enroll to allow autoenrollment
    ConflictException:
      type: object
      properties:
        Message:
          type: string
        ResourceId:
          type: string
          description: The identifier of the Amazon Web Services resource.
        ResourceType:
          type: string
          description: The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName,
            or DirectoryRegistration.
      required:
      - Message
      - ResourceId
      - ResourceType
    CreateTemplateGroupAccessControlEntryRequest:
      type: object
      properties:
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
        GroupSecurityIdentifier:
          type: string
          description: Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
        GroupDisplayName:
          type: string
          description: Name of the Active Directory group. This name does not need to match the group name in Active Directory.
        AccessRights:
          $ref: '#/components/schemas/AccessRights'
        ClientToken:
          type: string
          description: Idempotency token.
      required:
      - TemplateArn
      - GroupSecurityIdentifier
      - GroupDisplayName
      - AccessRights
    DeleteTemplateGroupAccessControlEntryRequest:
      type: object
      properties:
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
        GroupSecurityIdentifier:
          type: string
          description: Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
      required:
      - TemplateArn
      - GroupSecurityIdentifier
    GetTemplateGroupAccessControlEntryRequest:
      type: object
      properties:
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
        GroupSecurityIdentifier:
          type: string
          description: Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
      required:
      - TemplateArn
      - GroupSecurityIdentifier
    GetTemplateGroupAccessControlEntryResponse:
      type: object
      properties:
        AccessControlEntry:
          $ref: '#/components/schemas/AccessControlEntry'
    InternalServerException:
      type: object
      properties:
        Message:
          type: string
      required:
      - Message
    ListTemplateGroupAccessControlEntriesRequest:
      type: object
      properties:
        MaxResults:
          type: integer
          description: Use this parameter when paginating results to specify the maximum number of items to return in the
            response on each page. If additional items exist beyond the number you specify, the NextToken element is sent
            in the response. Use this NextToken value in a subsequent request to retrieve additional items.
        NextToken:
          type: string
          description: Use this parameter when paginating results in a subsequent request after you receive a response with
            truncated results. Set it to the value of the NextToken parameter from the response you just received.
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
      required:
      - TemplateArn
    ListTemplateGroupAccessControlEntriesResponse:
      type: object
      properties:
        AccessControlEntries:
          type: array
          items:
            $ref: '#/components/schemas/AccessControlEntrySummary'
          description: An access control entry grants or denies permission to an Active Directory group to enroll certificates
            for a template.
        NextToken:
          type: string
          description: Use this parameter when paginating results in a subsequent request after you receive a response with
            truncated results. Set it to the value of the NextToken parameter from the response you just received.
    ResourceNotFoundException:
      type: object
      properties:
        Message:
          type: string
        ResourceId:
          type: string
          description: The identifier of the Amazon Web Services resource.
        ResourceType:
          type: string
          description: The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName,
            or DirectoryRegistration.
      required:
      - Message
      - ResourceId
      - ResourceType
    ServiceQuotaExceededException:
      type: object
      properties:
        Message:
          type: string
        ResourceId:
          type: string
          description: The identifier of the Amazon Web Services resource.
        ResourceType:
          type: string
          description: The resource type, which can be one of Connector, Template, TemplateGroupAccessControlEntry, ServicePrincipalName,
            or DirectoryRegistration.
        ServiceCode:
          type: string
          description: Identifies the originating service.
        QuotaCode:
          type: string
          description: The code associated with the service quota.
      required:
      - Message
      - ResourceId
      - ResourceType
      - ServiceCode
      - QuotaCode
    ThrottlingException:
      type: object
      properties:
        Message:
          type: string
        ServiceCode:
          type: string
          description: Identifies the originating service.
        QuotaCode:
          type: string
          description: The code associated with the quota.
      required:
      - Message
    UpdateTemplateGroupAccessControlEntryRequest:
      type: object
      properties:
        TemplateArn:
          type: string
          description: The Amazon Resource Name (ARN) that was returned when you called CreateTemplate.
        GroupSecurityIdentifier:
          type: string
          description: Security identifier (SID) of the group object from Active Directory. The SID starts with "S-".
        GroupDisplayName:
          type: string
          description: Name of the Active Directory group. This name does not need to match the group name in Active Directory.
        AccessRights:
          $ref: '#/components/schemas/AccessRights'
      required:
      - TemplateArn
      - GroupSecurityIdentifier
    ValidationException:
      type: object
      properties:
        Message:
          type: string
        Reason:
          type: string
          enum:
          - FIELD_VALIDATION_FAILED
          - INVALID_CA_SUBJECT
          - INVALID_PERMISSION
          - INVALID_STATE
          - MISMATCHED_CONNECTOR
          - MISMATCHED_VPC
          - NO_CLIENT_TOKEN
          - UNKNOWN_OPERATION
          - OTHER
          description: The reason for the validation error. This won't be return for every validation exception.
      required:
      - Message
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/3cd98287b471c106254abd89279cc87308d38bfd/models/pca-connector-ad/service/2018-05-10/pca-connector-ad-2018-05-10.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)