Cumulocity Certificate authority API

openapi: 3.2.0
info:
  version: Latest
  title: Cumulocity Certificate authority API
  x-logo:
    url: https://www.cumulocity.com/docs/images/logo-platform.svg
    backgroundColor: '#F8F8F8'
    altText: Cumulocity
    href: https://www.cumulocity.com/api
  description: '# REST implementation


    This section describes the aspects common to all REST-based interfaces of Cumulocity. The interfaces are based on the Hypertext Transfer Protocol 1.1 using HTTPS. ## HTTP usage


    ### Application management


    Cumulocity uses a so-called "application key" to distinguish requests coming from devices and traffic from applications. If you write an application, pass the following header as part of all requests:


    ```markup

    X-Cumulocity-Application-Key:

    ```


    For example, if you registered your application in the Cumulocity Administration application with the key "myapp", your requests should contain the header:


    ```markup

    X-Cumulocity-Application-Key: myapp

    ```


    This makes your application subscribable and billable. If you implement a device, do not pass the key. > **ⓘ Info:** Make sure that you pass the key in **all** requests coming from an application. If you leave out the key,

    > the request will be considered as a device request, and the corresponding device will be marked as "available". ### Limited HTTP clients


    If you use an HTTP client that can only perform GET and POST methods in HTTP, you can emulate the other methods through an additional "X-HTTP-METHOD" header. Simply issue a POST request and add the header, specifying the actual REST method to be executed. For example, to emulate the "PUT" (modify) method, you can use:


    ```http

    POST ... X-HTTP-METHOD: PUT

    ```


    ### Processing mode


    Every update request (PUT, POST, DELETE) executes with a so-called *processing mode*. The processing modes are as follows:


    |Processing mode|Description|

    |---|---|

    |PERSISTENT (default)|Stores data in the Cumulocity database and sends data to the Streaming Analytics engine. Afterwards, Cumulocity returns the result of the request. This is the default mode.|

    |TRANSIENT|Sends data to the Streaming Analytics engine and immediately returns the results asynchronously but does not store data in Cumulocity’s database. This mode saves storage and processing costs and is useful for example when tracking devices in real time without requiring data to be stored.|

    |QUIESCENT|Behaves similar to the persistent mode with the exception that no real-time notifications will be sent.|

    |CEP|Behaves like the transient mode with the exception that no real-time notifications are sent.|


    To explicitly control the processing mode of an update request, you can use the "X-Cumulocity-Processing-Mode" header with a value of either "PERSISTENT", "TRANSIENT", "QUIESCENT" or "CEP":


    ```markup

    X-Cumulocity-Processing-Mode: PERSISTENT

    ```


    > **ⓘ Info:** Events are always delivered to CEP/Apama for all processing modes. This is independent from real-time notifications. ### Authorization


    All requests issued to Cumulocity are subject to authorization. To determine the required permissions, see the "Required role" entries for the individual requests. To learn more about the different permissions and the concept of ownership in Cumulocity, see Getting started > Technical concepts > Security aspects > Access control > Managing roles and assigning permissions in the Cumulocity user documentation. > **⚠️ Important:** In the Cumulocity API, each granular permission is identified by a unique “permission” string, which is prefixed with ROLE_ (for example, ROLE_ALARM_READ, ROLE_INVENTORY_ADMIN). Therefore, permissions are frequently referred to as “roles” throughout the API as well as in the configuration files. For example, the microservice manifest includes a requiredRoles field, which actually expects a permission string. See also the Glossary of the Cumulocity user documentation for the usage of the terms “permission” and “role” in the Cumulocity context. ### Media types


    Each type of data is associated with an own media type. The general format of media types is:


    ```markup

    application/vnd.com.nsn.cumulocity.+json;ver=;charset=UTF-8

    ```


    Each media type contains a parameter `ver` indicating the version of the type.'
servers:
- description: Cumulocity tenant
  url: https://<TENANT_DOMAIN>
security:
- Basic: []
- OAI-Secure: []
- SSO: []
- JWT-IAM: []
tags:
- name: Certificate authority
  description: API to create a new CA certificate for tenant in Cumulocity.
paths:
  /certificate-authority:
    post:
      operationId: postCertificateAuthorityResource
      x-codegen-resource-name: createCertificateAuthority
      parameters:
      - $ref: '#/components/parameters/acceptHeader'
      tags:
      - Certificate authority
      security:
      - Basic: []
      - OAI-Secure: []
      - SSO: []
      - JWT-IAM: []
      summary: Create Certificate Authority(CA) for a tenant with CN as tenantID
      description: 'Create a key pair and self-sign a certificate with as the Common Name (CN).

        Store the private key in an encrypted tenant option.

        Store the certificate in the trusted certificate repository with auto-registration checked by default. The devices can be registered automatically.

        If the CA certificate is removed from the trusted certificate list, corresponding public and private key removed automatically from the database collection.

        If a CA is already present, return a message indicating the CA is already present.


        Required roles


        ROLE_TENANT_MANAGEMENT_ADMIN

        ROLE_TENANT_ADMIN'
      x-code-samples:
      - lang: cURL
        source: 'curl --location --request POST "https://<TENANT_DOMAIN>/certificate-authority" \

          --header "Authorization: Basic <AUTHORIZATION>" \

          --header "Accept: application/json" \

          --header "Content-Type: application/json" \

          '
      - lang: C#
        source: 'var client = new RestClient("https://<TENANT_DOMAIN>/certificate-authority");

          client.Timeout = -1;


          var request = new RestRequest(Method.POST);

          request.AddHeader("Authorization", "Basic <AUTHORIZATION>");

          request.AddHeader("Content-Type", "application/json");

          request.AddHeader("Accept", "application/json");


          IRestResponse response = client.Execute(request);

          Console.WriteLine(response.Content);

          '
      - lang: Java
        source: "Unirest.setTimeouts(0, 0);\nHttpResponse<String> response = Unirest.post(\"https://<TENANT_DOMAIN>/certificate-authority\")\n    .header(\"Authorization\", \"Basic <AUTHORIZATION>\")\n    .header(\"Content-Type\", \"application/json\")\n    .header(\"Accept\", \"application/json\")\n    .asString();\nSystem.out.println(response);\n"
      - lang: Node.js
        source: "var unirest = require(\"unirest\");\nvar req = unirest(\"POST\", \"https://<TENANT_DOMAIN>/certificate-authority\")\n    .headers({\n        \"Authorization\": \"Basic <AUTHORIZATION>\",\n        \"Accept\": \"application/json\",\n        \"Content-Type\": \"application/json\"\n    })\n    .end(function (res) {\n        if (res.error) throw new Error(res.error);\n        console.log(res.raw_body);\n    });\n"
      - lang: Python
        source: "import requests\nimport json\n\nurl = \"https://<TENANT_DOMAIN>/certificate-authority\"\nheaders = {\n  \"Authorization\": \"Basic <AUTHORIZATION>\",\n  \"Accept\": \"application/json\",\n  \"Content-Type\": \"application/json\"\n}\nresponse = requests.request(\"POST\", url, headers=headers)\nprint(response.text.encode(\"utf8\"))\n"
      responses:
        '201':
          description: The tenant's CA certificate was added to the tenant.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/TrustedCertificate'
                - properties:
                    tenantCertificateAuthority:
                      example: true
        '401':
          $ref: '#/components/responses/unauthorizedError'
        '403':
          $ref: '#/components/responses/accessDenied'
        '404':
          $ref: '#/components/responses/certificateAuthorityObjectNotFound'
        '409':
          description: Duplicate – Tenant CA is already exists.
        '422':
          description: Unprocessable Entity – Invalid key pair configuration.
  /certificate-authority/renew:
    post:
      operationId: postRenewCertificateAuthorityResource
      x-codegen-resource-name: renewCertificateAuthority
      parameters:
      - $ref: '#/components/parameters/acceptHeader'
      tags:
      - Certificate authority
      security:
      - Basic: []
      - OAI-Secure: []
      - SSO: []
      - JWT-IAM: []
      summary: Renew Certificate Authority(CA) for a tenant with existing public and private…
      description: 'Renew the Certificate Authority (CA) for a tenant using existing public and private keys.

        The renewal will fail if either the public or private key is missing.

        If no CA exists, or if the current CA has more than 18 months remaining before expiration, a message will be returned indicating that the CA is either not present or not eligible for renewal.


        Required roles


        ROLE_TENANT_MANAGEMENT_ADMIN

        ROLE_TENANT_ADMIN'
      x-code-samples:
      - lang: cURL
        source: 'curl --location --request POST "https://<TENANT_DOMAIN>/certificate-authority/renew" \

          --header "Authorization: Basic <AUTHORIZATION>" \

          --header "Accept: application/json" \

          --header "Content-Type: application/json" \

          '
      - lang: C#
        source: 'var client = new RestClient("https://<TENANT_DOMAIN>/certificate-authority/renew");

          client.Timeout = -1;


          var request = new RestRequest(Method.POST);

          request.AddHeader("Authorization", "Basic <AUTHORIZATION>");

          request.AddHeader("Content-Type", "application/json");

          request.AddHeader("Accept", "application/json");


          IRestResponse response = client.Execute(request);

          Console.WriteLine(response.Content);

          '
      - lang: Java
        source: "Unirest.setTimeouts(0, 0);\nHttpResponse<String> response = Unirest.post(\"https://<TENANT_DOMAIN>/certificate-authority/renew\")\n    .header(\"Authorization\", \"Basic <AUTHORIZATION>\")\n    .header(\"Content-Type\", \"application/json\")\n    .header(\"Accept\", \"application/json\")\n    .asString();\nSystem.out.println(response);\n"
      - lang: Node.js
        source: "var unirest = require(\"unirest\");\nvar req = unirest(\"POST\", \"https://<TENANT_DOMAIN>/certificate-authority/renew\")\n    .headers({\n        \"Authorization\": \"Basic <AUTHORIZATION>\",\n        \"Accept\": \"application/json\",\n        \"Content-Type\": \"application/json\"\n    })\n    .end(function (res) {\n        if (res.error) throw new Error(res.error);\n        console.log(res.raw_body);\n    });\n"
      - lang: Python
        source: "import requests\nimport json\n\nurl = \"https://<TENANT_DOMAIN>/certificate-authority/renew\"\nheaders = {\n  \"Authorization\": \"Basic <AUTHORIZATION>\",\n  \"Accept\": \"application/json\",\n  \"Content-Type\": \"application/json\"\n}\nresponse = requests.request(\"POST\", url, headers=headers)\nprint(response.text.encode(\"utf8\"))\n"
      responses:
        '201':
          description: The tenant's CA certificate renewed successfully.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/TrustedCertificate'
                - properties:
                    tenantCertificateAuthority:
                      example: true
        '401':
          $ref: '#/components/responses/unauthorizedError'
        '403':
          $ref: '#/components/responses/accessDenied'
        '404':
          $ref: '#/components/responses/certificateAuthorityObjectNotFound'
components:
  responses:
    certificateAuthorityObjectNotFound:
      description: Tenant Certificate Authority (CA) object not found.
      content:
        application/vnd.com.nsn.cumulocity.error+json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            error: Certificate Authority (CA)/Not Found
            message: Tenant Certificate Authority (CA) object not found for tenant t04
            info: https://www.cumulocity.com/guides/reference-guide/#error_reporting
    unauthorizedError:
      description: Authentication information is missing or invalid.
      content:
        application/vnd.com.nsn.cumulocity.error+json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            error: security/Unauthorized
            message: 'Invalid credentials! : Bad credentials'
            info: https://www.cumulocity.com/guides/reference-guide/#error_reporting
    accessDenied:
      description: Not enough permissions/roles to perform this operation.
      content:
        application/vnd.com.nsn.cumulocity.error+json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            error: security/Forbidden
            message: Access is denied.
            info: https://www.cumulocity.com/guides/reference-guide/#error_reporting
  parameters:
    acceptHeader:
      name: Accept
      in: header
      description: Advertises which content types, expressed as MIME types, the client is able to understand.
      required: false
      schema:
        type: string
        minLength: 1
        example: application/json
  schemas:
    desc_self:
      title: SelfURL
      description: A URL linking to this resource.
      type: string
      format: uri
      readOnly: true
    error:
      type: object
      properties:
        error:
          description: The type of error returned.
          type: string
        message:
          description: A human-readable message providing more details about the error.
          type: string
        info:
          description: A URI reference [[RFC3986](https://tools.ietf.org/html/rfc3986)] that identifies the error code reported.
          type: string
    TrustedCertificate:
      type: object
      properties:
        algorithmName:
          description: Algorithm used to decode/encode the certificate.
          type: string
          readOnly: true
        autoRegistrationEnabled:
          description: Indicates whether the automatic device registration is enabled or not.
          type: boolean
          default: false
        certInPemFormat:
          description: Trusted certificate in PEM format.
          type: string
        fingerprint:
          description: Unique identifier of the trusted certificate.
          type: string
          readOnly: true
        issuer:
          description: The name of the organization which signed the certificate.
          type: string
          readOnly: true
        name:
          description: Name of the certificate.
          type: string
        notAfter:
          description: The end date and time of the certificate's validity.
          type: string
          format: date-time
          readOnly: true
        notBefore:
          description: The start date and time of the certificate's validity.
          type: string
          format: date-time
          readOnly: true
        proofOfPossessionValid:
          description: Indicates whether the proof of possession for the certificate was provided.
          type: boolean
          example: false
        proofOfPossessionUnsignedVerificationCode:
          description: An unsigned verification code that provides proof of possession for the certificate after signing.
          type: string
          example: 6qgyIiqnYAx+1pkSSgy1o8tNHBVFx0Xx959fWmrXfSKsgBEggyR+er6KVgag1oMrdS6L3gBLmU3wKQk83RsdHSJkWoQ/2oRt5Czyy2ViobYaG8GVjz3pEcJ/Vz8e2PjjBYFYCvlGF08pZRJMjbTUHpe6p4wBFlK2
        proofOfPossessionVerificationCodeUsableUntil:
          description: Validity of the verification code.
          type: string
          format: date-time
          example: '2024-03-19T00:00:00.000Z'
        self:
          $ref: '#/components/schemas/desc_self'
        serialNumber:
          description: The certificate's serial number.
          type: string
          readOnly: true
        status:
          description: Indicates if the certificate is active and can be used by the device to establish a connection to the Cumulocity platform.
          type: string
          enum:
          - ENABLED
          - DISABLED
          example: ENABLED
        subject:
          description: Name of the organization to which the certificate belongs.
          type: string
          readOnly: true
        version:
          description: Version of the X.509 certificate standard.
          type: integer
          readOnly: true
        tenantCertificateAuthority:
          description: Indicates whether this certificate is tenant's CA.
          type: boolean
          default: false
          readOnly: true
      example:
        algorithmName: SHA256withRSA
        version: 3
        autoRegistrationEnabled: true
        issuer: CN=CertificateName, OU=Dusseldorf, O=Cumulocity, C=DE
        name: My Certificate
        fingerprint: df9c19e0433c6861fak899078b76fe56a3e7dd14
        notAfter: '2041-08-29T07:42:00.000Z'
        notBefore: '2021-09-03T07:42:00.000Z'
        serialNumber: '304307049989715896618044547121406628655049752690'
        subject: CN=CertificateName, OU=Dusseldorf, O=Cumulocity, C=DE
        self: https://<TENANT_DOMAIN>/tenant/tenants/t07007007/trusted-certificates/df9c19e0433c6861fak899078b76fe56a3e7dd14
        status: ENABLED
        tenantCertificateAuthority: false
        certInPemFormat: 'MIIFezCCA2OgAwIBAgIUNU2ZnXIdu9aq+O7x2emLTgXgQEowDQYJKoZIhvcNAQEL

          BQAwRTELMAkGA1UEBhMCUEwxDzANBgNVBAoMBmluZXR1bTEPMA0GA1UECwwGbHVi

          bGluMRQwEgYDVQQDDAtiYXNpY0NvbW1vbjAeFw0yMTA5MDMwNzQyMDBaFw00MTA4

          MjkwNzQyMDBaMEUxCzAJBgNVBAYTAlBMMQ8wDQYDVQQKDAZpbmV0dW0xDzANBgNV

          BAsMBmx1YmxpbjEUMBIGA1UEAwwLYmFzaWNDb21tb24wggIiMA0GCSqGSIb3DQEB

          AQUAA4ICDwAwggIKAoICAQDEc1NevRvKaIDs5CsGbIc/ETm3gHmG3OP9Z8ULQv1y

          W1VzdjSKfgoVWVEsbhuhaRaWyIuaFh6dsWpWEcXpHkq+DiRuQGifBmUNFURZQ8Aw

          UOrQ4F10UuzulEYauYh218rGSynLnIXCO3UHXGjWX+iiXPjbesFcnLPaarmLmQU9

          AAh9MpBb3ztMzh5wRGcyVpuDxZ7e0HDBlI7hNMEqCFO/brJsILtv5q0j4JoShyWX

          NVV8tX8P+biMlyMcVoZJazBfYuYErxmxdXtORxOkfge815ltGoMI9V4YSSex3/Fv

          /PBavpF4iueqcrWQF3dhctAViPEzpMoefTu+cFtB/40wx/NHiBF5x5rjcT2s/+6W

          b9OGLxLLf84XpYlHWtucfFLzznPMiXNegfkJpU0dMuMh1GT5WNTfmcPV3LiasbI0

          GNq6mWKLgcRHX95pw16vw0CqzPnFTASztnI12mIYm6D0oQ+tHjLoPrW3fiZEeF67

          fVA8LNWJwCkzHlnnNl5HP15K+GoscyzyMKj7ViAqN+XZaCRpRqYNZGkGXB9mSVQn

          0oK6eRX8oQ4NQQW49VNoho9I8DhcCdMglMj9bhciIy2LrSwB8Sx9nB1C9wiHDbCA

          fTy1nxEJS9gUGg7LNmRxlpQFBuQ0ndq87UEUdjchvbmJD7T5ZYM0LgDopJypBsqF

          gQIDAQABo2MwYTAdBgNVHQ4EFgQUUS08257ro38KOB1a8pqYL3P2NvAwHwYDVR0j

          BBgwFoAUUS08257ro38KOB1a8pqYL3P2NvAwEgYDVR0TAQH/BAgwBgEB/wIBCjAL

          BgNVHQ8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAGtYjON+CFzVGRkajHK1RKZS

          J4kAfQlrXq1vG2b4jWYSLgrNw4o93xx0yLK0HVHO12juFhUrmlfhCB/iGI9iL2IO

          h7v+PQ4L5wQJWfxZNWDZpqbF3S7UyDGAFx1J3MwjIhkoPpaIB0km+sQCJxn5Vt36

          OPCKmORm4tplBHNauP9PpS418HAC9uyrew/h/0BLLaPF9BwFWk4HmSwfSFTHOvyh

          hC1G4cEzHuiadLGCPXwerCe5As9F4InvIYmQ4UxAOtnlQcnQYOowFSrMobkArGR9

          HcG1b0vWQJdzVrDU7zcRzD90ehwsXJIczOQoa/Hmb3Njlop8LyTFPjeXeoJf6PJE

          MHy08IOLvaX4UsRiKLKJ28JEhVVemBrPspHeADqmlbeBotQ6OToWFeki9qQSz5Lw

          lks/4qfRn6Xl3rmRSH8FdbK3VdIYInT7PTz5W2EBE8Ql5vneSPb9aank+9H67mB5

          GQ8uYpxcs6Qjyy62pkfejlHHHh5oqEq0b6w7YyUuMAEW0JB0WevoCS8iVl8hKbyK

          94u/PqW6lH+agw4kaMzaeMwBmppAy4JsiEKKavvP3jO6NDMc1bHt5q2+XTRPdlQY

          DVZJfXybnOvsTQv41A4zyHSaNZsH1AyhJPfFKAMPXhajm7dBCi87bamMj4NyZt8f

          PPBUaE6x9fMfuGJbcsAR

          '
  securitySchemes:
    Basic:
      type: http
      scheme: basic
      description: 'The authorization header is formed as `Basic <Base64(<tenantID>/<c8yuser>:<password>)>`. For instance, if your tenantID, username and password are **t0071234**, **testuser** and **secret123** respectively, you can generate the Base64 string with the following command:


        ```shell

        $ echo -n t0071234/testuser:secret123 | base64

        ```


        and your authorization header would look like this:


        ```

        "Authorization": "Basic dDAwNzEyMzQvdGVzdHVzZXI6c2VjcmV0MTIz"

        ```

        '
    OAI-Secure:
      type: http
      scheme: bearer
      description: 'This is the recommended authorization method because it provides high security using authorization tokens to prove the identity of the user, and it is the default login mode on creating new tenants. This mode is an enhancement of the previous OAuth Internal authentication (available prior to 10.13.0).


        For more details about OAI-Secure authentication, see [Platform administration > Authentication > Basic settings > Login settings](https://www.cumulocity.com/docs/authentication/basic-settings/#login-settings) in the Cumulocity user documentation.

        '
    SSO:
      type: oauth2
      description: "The login with SSO requires a correct configuration on the [Cumulocity side](https://www.cumulocity.com/docs/authentication/sso/). With the configuration, an additional button is available on the Login page. After clicking the button, the user is redirected to authenticate with the configured authorization server. On successful login, the user is redirected to Cumulocity.\n\nAuthentication details are exchanged using cookies. There are two parts to it, the first is the authentication cookie that is handled automatically by the Cumulocity platform. The second is the XSRF-TOKEN cookie. When a client receives the cookie, it should take the value and put it in the X-XSRF-TOKEN request header in all subsequent requests.\n\nThe flow of authenticating with authentication code grant is as follows:\n\n![Authentication flow](images/oauth-simple-flow.png)\n\nThe first request executed by the browser is:\n\n```http\nGET /tenant/loginOptions\nHost: https://<TENANT_DOMAIN>\nAccept: application/vnd.com.nsn.cumulocity.loginoptioncollection+json\n```\n\nResponse sample:\n\n```json\n{\n    \"loginOptions\": [\n        {\n            \"buttonName\": \"Login with oauth\",\n            \"grantType\": \"<AUTHORIZATION_CODE>\",\n            \"initRequest\": \"https://<TENANT_DOMAIN>/tenant/oauth?response_type=code&tenant_id=<TENANT_ID>\",\n            \"self\": \"https://<TENANT_DOMAIN>/tenant/loginOptions/oauth2\",\n            \"type\": \"oauth2\"\n        },\n        ...\n    ],\n    \"self\": \"http://<TENANT_DOMAIN>/tenant/loginOptions/\"\n}\n```\n\nThe browser must invoke the request provided in the initRequest parameter.\n\nThe initRequest initiates the redirect, in which the user is prompted for credentials. After successful login, the user is redirected back to the browser, where it must capture the code request parameter. Then the request to exchange the code for the token is as follows:\n\n```http\nPOST /tenant/oauth?grant_type=authorization_code&code=<CODE>\nHost: https://<TENANT_DOMAIN>\n```\n\nA successful response will have no body but the following response headers:\n\n```\nSet-Cookie: authorization=<TOKEN>;\nSet-Cookie: XSRF-TOKEN=<XSRF-TOKEN>;\n```\n\nThe authorization cookie is valid for two weeks.\n"
      flows:
        clientCredentials:
          tokenUrl: /tenant/oauth?grant_type=authorization_code&code=<CODE>
          scopes: {}
    JWT-IAM:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'This kind of authentication substitutes the JWT authentication with OAuth2 access tokens from your Identity and Access Management (IAM).

        You can enable this in the [SSO configuration](https://www.cumulocity.com/docs/authentication/sso/).


        The HTTP header must include:


        ```

        "Authorization": "Bearer <Access token>"

        ```


        When a request with a bearer token in the header is received, Cumulocity checks if the access token is from your IAM (that is, if authentication is enabled in your SSO configuration), and verifies the authenticity of

        the token remotely against the IAM.

        '
x-tagGroups:
- name: Platform
  tags:
  - Platform API
- name: Alarms
  tags:
  - Alarm API
  - Alarm notification API
  - Alarms
- name: Applications
  tags:
  - Application API
  - Applications
  - Application versions
  - Application binaries
  - Bootstrap user
  - Current application
- name: Audits
  tags:
  - Audit API
  - Audits
- name: Device control
  tags:
  - Device control API
  - Device control notification API
  - Operations
  - Bulk operations
  - Device credentials
  - New device requests
  - Device control via SMS
- name: Events
  tags:
  - Event API
  - Event notification API
  - Events
  - Attachments
- name: Feature toggles
  tags:
  - Feature toggles API
- name: Identity
  tags:
  - Identity API
  - External IDs
- name: Inventory
  tags:
  - Inventory API
  - Inventory notification API
  - Managed objects
  - Binaries
  - Child operations
  - Query language
- name: Measurements
  tags:
  - Measurement API
  - Measurement notification API
  - Measurements
  - Measurements specifics
- name: Notifications 2.0
  tags:
  - About notifications 2.0
  - Notification 2.0 API
  - Subscriptions
  - Tokens
- name: Real-time notifications
  tags:
  - Real-time notification API
- name: Retentions
  tags:
  - Retention rules
- name: Tenants
  tags:
  - Tenant API
  - Tenants
  - Tenant applications
  - Trusted certificates
  - Device statistics
  - Usage statistics
  - Options
  - Login options
  - Login tokens
  - System options
- name: Users
  tags:
  - User API
  - Current User
  - Users
  - Groups
  - Roles
  - Inventory Roles
  - Device Permissions
- name: Certificate
  tags:
  - Certificate authority
  - Device enrollment
x-provenance:
  method: harvested
  publisher: Cumulocity
  source: https://cumulocity.com/api/core/dist/c8y-oas.yml
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)