Fortanix Account Extensions API

openapi: 3.2.0
info:
  title: Fortanix DSM REST Account Extensions API
  description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update."
  termsOfService: https://fortanix.com/legal/agreements-and-standard-terms
  contact:
    name: Fortanix Support
    url: https://support.fortanix.com/
    email: support@fortanix.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 0.1.0-20260710
servers:
- url: '{dsmEndpoint}'
  description: DSM Endpoint
  variables:
    dsmEndpoint:
      default: https://amer.smartkey.io
      description: Type your DSM server URL here (include https://)
tags:
- name: Account_extensions
paths:
  /sys/v1/account_extensions/{acct_id}:
    put:
      operationId: CreateAccountExtension
      tags:
      - Account_extensions
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Create a new account extension.
      description: Create a new account extension.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountExtensionCreateRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountExtension'
    get:
      operationId: GetAccountExtension
      tags:
      - Account_extensions
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get info for a specific account extension.
      description: Get info for a specific account extension.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountExtension'
    patch:
      operationId: UpdateAccountExtension
      tags:
      - Account_extensions
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Update specific account extension.
      description: Update specific account extension.
      parameters:
      - name: acct_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountExtensionRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountExtension'
components:
  schemas:
    FpeDate:
      description: 'A structure for specifying a token part representing a date that occurs after a specified date

        and/or occurs before a specified date. Depending on the subparts that make up the date, one of

        the three options is used.'
      oneOf:
      - title: FpeDateVariantDayMonthYear
        type: object
        properties:
          dmy_date:
            $ref: '#/components/schemas/FpeDateDayMonthYear'
        required:
        - dmy_date
      - title: FpeDateVariantMonthDay
        type: object
        properties:
          month_day_date:
            $ref: '#/components/schemas/FpeDateMonthDay'
        required:
        - month_day_date
      - title: FpeDateVariantMonthYear
        type: object
        properties:
          month_year_date:
            $ref: '#/components/schemas/FpeDateMonthYear'
        required:
        - month_year_date
    SigningKeysVariantStored:
      allOf:
      - type: object
        properties:
          kind:
            type: string
            enum:
            - stored
        required:
        - kind
      - $ref: '#/components/schemas/SigningKeysStored'
    FpeDataPart:
      description: Structure for specifying (part of) a complex tokenization data type.
      oneOf:
      - $ref: '#/components/schemas/FpeEncryptedPart'
      - $ref: '#/components/schemas/FpeDataPartLiteral'
      - $ref: '#/components/schemas/FpeCompoundPart'
    FpeDayMonthDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a day and a month, for use in an

          FpeDate structure.'
        properties:
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
          day:
            type: integer
            minimum: 0
            maximum: 255
            description: 'The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month

              and year. Here, February is treated as having 29 days.'
        required:
        - month
        - day
    FpeInputProcessing:
      description: Options to apply some pre- and post-processing to the input.
      oneOf:
      - title: FpeInputProcessingVariantStripUnknown
        type: string
        enum:
        - strip_unknown
      - title: FpeInputProcessingVariantPassthroughUnknown
        type: string
        enum:
        - passthrough_unknown
      - title: FpeInputProcessingVariantPassthroughSpecific
        type: object
        properties:
          passthrough_specific:
            $ref: '#/components/schemas/FpeInputProcessingPassthroughSpecific'
        required:
        - passthrough_specific
    CertificateOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    SigningKeysStored:
      allOf:
      - type: object
        properties:
          keys:
            type: object
            additionalProperties:
              type: string
              format: byte
            description: Mapping key ids to DER-encoded public key.
        required:
        - keys
    Des3OptionsPolicy:
      allOf:
      - type: object
        description: 'Cryptographic policy for triple DES objects. Setting `key_sizes: [168]`

          forbids two-key triple DES.'
        properties:
          key_sizes:
            type:
            - array
            - 'null'
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
          random_iv:
            type:
            - boolean
            - 'null'
    FpeInputProcessingPassthroughSpecific:
      allOf:
      - type: object
        properties:
          passthrough:
            type: array
            uniqueItems: true
            items:
              type: string
              minLength: 1
              maxLength: 1
          other:
            $ref: '#/components/schemas/FpeInputDefaultProcessing'
        required:
        - passthrough
        - other
    LmsOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    FpeConstraints:
      allOf:
      - type: object
        description: Constraints on a portion of a complex tokenization data type.
        properties:
          luhn_check:
            type:
            - boolean
            - 'null'
            description: 'Whether the token part contains a checksum that satisfies the Luhn formula. It is an

              error to apply this constraint to non-numeric parts, or to have an encrypted part be

              under more than one Luhn check constraint. Also, if an encrypted part has a Luhn check

              constraint applied to it and may contain at least one digit that is not preserved, it

              must not specify any other constraints.'
          num_gt:
            type:
            - integer
            - 'null'
            description: 'Number that the token part should be greater than.


              This constraint can only be specified on (non-compound) numeric encrypted parts

              guaranteed to preserve either everything or nothing at all. (For example, if an

              encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the

              first five digits is not guaranteed to preserve everything, because if the input

              happens to be six or more digits long, there will be at least one digit that

              remains unpreserved.)'
          num_lt:
            type:
            - integer
            - 'null'
            description: 'Number that the token part should be smaller than.


              This constraint can only be specified on (non-compound) numeric encrypted parts

              guaranteed to preserve either everything or nothing at all. (For example, if an

              encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the

              first five digits is not guaranteed to preserve everything, because if the input

              happens to be six or more digits long, there will be at least one digit that

              remains unpreserved.)'
          num_ne:
            type:
            - array
            - 'null'
            items:
              type: integer
            description: 'Numbers that the token part should not be equal to. It is an error to apply this

              constraint to non-numeric parts.'
          date:
            $ref: '#/components/schemas/FpeDateConstraint'
          applies_to:
            $ref: '#/components/schemas/FpeConstraintsApplicability'
    FpeCompoundPartOr:
      allOf:
      - type: object
        description: 'Represents an OR of multiple structures.


          Implementation note: an OR is _not_ a union of `FpeDataPart`s. Rather, when parsing

          the input, the backend will simply choose the first subpart that matches the current

          portion of the input, and tokenize/detokenize accordingly. If that choice results in

          an invalid parse of the rest of the input, the backend ***will not backtrack*** and

          will simply return with an error.'
        properties:
          or:
            type: array
            items:
              $ref: '#/components/schemas/FpeDataPart'
            description: The actual subparts that make up this compound part.
          constraints:
            $ref: '#/components/schemas/FpeConstraints'
          preserve:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire OR should be preserved as-is (i.e., not tokenized). If this is

              set, any descendant subparts cannot contain any preserve-related fields set.'
          mask:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire OR should be masked when doing masked decryption. If this is set,

              any descendant subparts cannot contain any mask-related fields set.'
          min_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for this part (in chars).
          max_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for this part (in chars).
        required:
        - or
    EcKcdsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    LegacyKeyPolicy:
      type: string
      enum:
      - allowed
      - prohibited
      - unprotect_only
    MetadataStringConstraintRequired:
      allOf:
      - type: object
        properties:
          non_empty_after_trim:
            type:
            - boolean
            - 'null'
            description: 'If set to `true`, the value must have a length > 0 after trimming

              leading and trailing whitespace characters.'
          allowed_values:
            type:
            - array
            - 'null'
            uniqueItems: true
            items:
              type: string
            description: If not specified or empty, it will not impose any restrictions on the value.
    FpeDayMonthYearDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a day, month, and year, for use in

          an FpeDate structure.'
        properties:
          year:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The year, which should be an integer less than 100000. Zero is treated as a leap year.
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
          day:
            type: integer
            minimum: 0
            maximum: 255
            description: 'The day, which should be an integer from 1 to either 28, 29, 30, or 31, depending on the

              month and year.'
        required:
        - year
        - month
        - day
    MlDsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    FpeOptions:
      description: 'FPE-specific options (for specifying the format of the

        data to be encrypted)'
      oneOf:
      - $ref: '#/components/schemas/FpeOptionsBasic'
      - $ref: '#/components/schemas/FpeOptionsAdvanced'
      - $ref: '#/components/schemas/FpeOptionsV2'
    DsaOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    KeyHistoryPolicy:
      allOf:
      - type: object
        description: Configuration for a key history (aka key undo) policy.
        properties:
          undo_time_window:
            $ref: '#/components/schemas/Secs'
        required:
        - undo_time_window
    FpeSection:
      allOf:
      - type: object
        description: A concatenation of groups, optionally including a checksum.
        properties:
          groups:
            type: array
            items:
              $ref: '#/components/schemas/FpeGroup'
          checksum:
            $ref: '#/components/schemas/FpeChecksum'
        required:
        - groups
    CryptographicPolicy:
      allOf:
      - type: object
        properties:
          aes:
            $ref: '#/components/schemas/AesOptionsPolicy'
          aria:
            $ref: '#/components/schemas/AriaOptionsPolicy'
          des3:
            $ref: '#/components/schemas/Des3OptionsPolicy'
          rsa:
            $ref: '#/components/schemas/RsaOptionsPolicy'
          hmac:
            $ref: '#/components/schemas/HmacOptionsPolicy'
          ec:
            $ref: '#/components/schemas/EcOptionsPolicy'
          legacy_policy:
            $ref: '#/components/schemas/LegacyKeyPolicy'
          key_ops:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/KeyOperations'
          des:
            $ref: '#/components/schemas/DesOptionsPolicy'
          seed:
            $ref: '#/components/schemas/SeedOptionsPolicy'
          dsa:
            $ref: '#/components/schemas/DsaOptionsPolicy'
          kcdsa:
            $ref: '#/components/schemas/KcdsaOptionsPolicy'
          eckcdsa:
            $ref: '#/components/schemas/EcKcdsaOptionsPolicy'
          lms:
            $ref: '#/components/schemas/LmsOptionsPolicy'
          xmss:
            $ref: '#/components/schemas/XmssOptionsPolicy'
          mldsa:
            $ref: '#/components/schemas/MlDsaOptionsPolicy'
          mlkem:
            $ref: '#/components/schemas/MlKemOptionsPolicy'
          bip32:
            $ref: '#/components/schemas/Bip32OptionsPolicy'
          slip10:
            $ref: '#/components/schemas/Slip10OptionsPolicy'
          bls:
            $ref: '#/components/schemas/BlsOptionsPolicy'
          opaque:
            $ref: '#/components/schemas/OpaqueOptionsPolicy'
          secret:
            $ref: '#/components/schemas/SecretOptionsPolicy'
          certificate:
            $ref: '#/components/schemas/CertificateOptionsPolicy'
    FpeMonthYearDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a month and a year, for use in an

          FpeDate structure.'
        properties:
          year:
            type: integer
            minimum: 0
            maximum: 4294967295
            description: The year, which should be an integer less than 100000. Zero is treated as a leap year.
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
        required:
        - year
        - month
    FpeVariant:
      allOf:
      - type: object
        description: A concatenation of sections.
        properties:
          sections:
            type: array
            items:
              $ref: '#/components/schemas/FpeSection'
        required:
        - sections
    Bip32OptionsPolicy:
      allOf:
      - type: object
        properties: {}
    FpeDateDayMonthYear:
      allOf:
      - type: object
        description: 'Represents a date that consists of a Month subpart, a Day subpart, and a Year subpart. The

          Year part is allowed to be preserved, and the Day and Month parts are allowed to be

          preserved together. (The Day part cannot be preserved if the Month part is not, and vice

          versa.)'
        properties:
          before:
            $ref: '#/components/schemas/FpeDayMonthYearDate'
          after:
            $ref: '#/components/schemas/FpeDayMonthYearDate'
    FpeCompoundPartMultiple:
      allOf:
      - type: object
        description: 'Indicates a part that is possibly repeated multiple times.


          Implementation note: the backend parser is locally "greedy" and will attempt to match

          as many repetitions as possible. If this later results in an invalid parse of the rest

          of the input, the backend ***will not backtrack*** and will simply return with an error.'
        properties:
          multiple:
            $ref: '#/components/schemas/FpeDataPart'
          min_repetitions:
            type:
            - integer
            - 'null'
            description: 'The minimum number of times the subpart may occur. (A value of 1 marks a single

              occurrence.)'
          max_repetitions:
            type:
            - integer
            - 'null'
            description: 'The maximum number of times the subpart may occur. (A value of 1 marks a single

              occurrence.)'
          constraints:
            $ref: '#/components/schemas/FpeConstraints'
          preserve:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire Multiple should be preserved as-is (i.e., not tokenized). If this

              is set, the `multiple` subpart and its descendants cannot contain any preserve-related

              fields set.'
          mask:
            type:
            - boolean
            - 'null'
            description: 'Whether the entire Multiple should be masked when doing masked decryption. If this is

              set, the `multiple` subpart and its descendants cannot contain any mask-related fields

              set.'
          min_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The minimum allowed length for this part (in chars).
          max_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: The maximum allowed length for this part (in chars).
        required:
        - multiple
    All:
      description: 'A helper enum with a single variant, All, which indicates that something should apply to an

        entire part. (This is here mainly to allow other untagged enums to work properly.)'
      type: string
      enum:
      - all
    HmacOptionsPolicy:
      allOf:
      - type: object
        properties:
          minimum_key_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
    FpeWords:
      description: A set of fixed-length strings.
      oneOf:
      - title: FpeWordsVariantIntegerRanges
        type: object
        properties:
          integer_ranges:
            $ref: '#/components/schemas/FpeWordsIntegerRanges'
        required:
        - integer_ranges
      - title: FpeWordsVariantAlphabet
        type: object
        properties:
          alphabet:
            $ref: '#/components/schemas/FpeCharSet'
        required:
        - alphabet
      - title: FpeWordsVariantCustom
        type: object
        properties:
          custom:
            $ref: '#/components/schemas/FpeWordsCustom'
        required:
        - custom
    Secs:
      allOf:
      - type: integer
    RestrictedDuration:
      allOf:
      - type: object
        properties:
          min:
            $ref: '#/components/schemas/TimeSpan'
          max:
            $ref: '#/components/schemas/TimeSpan'
          default:
            $ref: '#/components/schemas/TimeSpan'
    MetadataDurationConstraint:
      oneOf:
      - title: MetadataDurationConstraintVariantForbidden
        type: object
        properties:
          forbidden:
            type: object
            properties: {}
        required:
        - forbidden
      - title: MetadataDurationConstraintVariantRequired
        type: object
        properties:
          required:
            $ref: '#/components/schemas/MetadataDurationConstraintRequired'
        required:
        - required
    SeedOptionsPolicy:
      allOf:
      - type: object
        properties:
          random_iv:
            type:
            - boolean
            - 'null'
    RsaEncryptionPaddingPolicy:
      description: RSA encryption padding policy.
      oneOf:
      - title: RsaEncryptionPaddingPolicyVariantOaep
        type: object
        properties:
          OAEP:
            $ref: '#/components/schemas/RsaEncryptionPaddingPolicyOaep'
        required:
        - OAEP
      - title: RsaEncryptionPaddingPolicyVariantPkcs1V15
        type: object
        properties:
          PKCS1_V15:
            type: object
            properties: {}
        required:
        - PKCS1_V15
      - title: RsaEncryptionPaddingPolicyVariantRawDecrypt
        type: object
        properties:
          RAW_DECRYPT:
            type: object
            properties: {}
        required:
        - RAW_DECRYPT
    MgfPolicy:
      description: MGF policy.
      oneOf:
      - title: MgfPolicyVariantMgf1
        type: object
        properties:
          mgf1:
            $ref: '#/components/schemas/MgfPolicyMgf1'
        required:
        - mgf1
    RsaSignaturePaddingPolicyPss:
      allOf:
      - type: object
        properties:
          mgf:
            $ref: '#/components/schemas/MgfPolicy'
    SigningKeys:
      description: 'Signing keys used to validate JSON Web Signature objects including signed

        JSON Web Tokens.'
      oneOf:
      - $ref: '#/components/schemas/SigningKeysVariantStored'
      - $ref: '#/components/schemas/SigningKeysVariantFetched'
      discriminator:
        propertyName: kind
        mapping:
          stored: SigningKeysVariantStored
          fetched: SigningKeysVariantFetched
    FpePreserveMask:
      description: A structure indicating which indices in an encrypted part to mask or preserve.
      oneOf:
      - $ref: '#/components/schemas/All'
      - type: array
        items:
          type: integer
          format: int64
        description: 'Indicates that only certain characters are to be preserved or masked. Indices are

          Python-like; i.e., negative indices index from the end of the token portion, with

          index -1 denoting the last character. (Indicating that nothing should be preserved

          or masked can be done via an empty list, which is the default value for this enum.)'
    RsaEncryptionPaddingPolicyOaep:
      allOf:
      - type: object
        description: 'The Optional Asymmetric Encryption Padding scheme, as defined

          in RFC 8017 (PKCS #1 version 2.2)'
        properties:
          mgf:
            $ref: '#/components/schemas/MgfPolicy'
    MlKemOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    OpaqueOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    MgfPolicyMgf1:
      allOf:
      - type: object
        properties:
          hash:
            $ref: '#/components/schemas/DigestAlgorithm'
    AccountExtensionRequest:
      allOf:
      - type: object
        properties:
          cryptographic_policy:
            $ref: '#/components/schemas/RemovableCryptographicPolicy'
          key_history_policy:
            $ref: '#/components/schemas/RemovableKeyHistoryPolicy'
          key_metadata_policy:
            $ref: '#/components/schemas/RemovableKeyMetadataPolicy'
          custom_metadata:
            type:
            - object
            - 'null'
            additionalProperties:
              type: string
          custom_metadata_attributes:
            type:
            - object
            - 'null'
            additionalProperties:
              $ref: '#/components/schemas/CustomAttributeSearchMetadata'
          plugin_code_signing_policy:
            $ref: '#/components/schemas/RemovablePluginCodeSigningPolicy'
          mark_key_disabled_when_deactivated:
            type:
            - boolean
            - 'null'
    MetadataPolicyItem:
      allOf:
      - type: object
        properties:
          custom_metadata:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/MetadataStringConstraint'
          description:
            $ref: '#/components/schemas/MetadataStringConstraint'
          deactivation_date:
            $ref: '#/components/schemas/MetadataDurationConstraint'
          activation_date:
            $ref: '#/components/schemas/MetadataDurationConstraint'
        required:
        - custom_metadata
    FpeGroup:
      allOf:
      - type: object
        description: 'A concatenation of codes, that can be repeated an amount of times. An

          amount of leading and trailing characters can be preserved, this is,

          unmodified by tokenization.'
        properties:
          codes:
            type: array
            items:
              $ref: '#/components/schemas/FpeCode'
          min_repetitions:
            type:
            - integer
            - 'null'
            description: A group cannot be omitted, thus this field must be positive if present.
          max_repetitions:
            type:
            - integer
            - 'null'
          preserve:
            type:
            - array
            - 'null'
            items:
              type: integer
            minItems: 2
            maxItems: 2
            description: 'Amount of leading and trailing characters to preserve in this group.

              Preserved characters are the leading/trailing characters of the whole

              group, not individual repetitions.'
        required:
        - codes
    FpeChecksum:
      type: string
      enum:
      - luhn
    FpeCharSet:
      description: 'The alphabet to use for an encrypted portion of a complex tokenization data type.

        Characters should be specified as a list of pairs, where each pair [a, b] represents the

        range of Unicode code points from a to b, with both bounds being inclusive. A single

        code point can be specified as [c, c].


        Normally, each character is assigned a numeric value for FF1. The first character is

        assigned a value of 0, and subsequent characters are assigned values of 1, 2, and so on,

        up to the size of the alphabet. Note that the order of the ranges matters; characters

        appearing in later ranges are assigned higher numerical values compared to earlier

        characters. For instance, in the FpeCharSet [[''a'', ''z''], [''0'', ''9'']], the digits ''0'' to

        ''9'' are assigned values from 26 to 35, since they are listed after the ''a'' to ''z'' range.


        In any case, ranges should not overlap with each other, and should not contain surrogate

        code points.'
      allOf:
      - type: array
        items:
          type: array
          minItems: 2
          maxItems: 2
          items:
            type: string
            minLength: 1
            maxLength: 1
    EllipticCurve:
      description: Identifies a standardized elliptic curve.
      type: string
      enum:
      - X25519
      - Ed25519
      - Ed448
      - X448
      - SecP192K1
      - SecP224K1
      - SecP256K1
      - NistP192
      - NistP224
      - NistP256
      - NistP384
      - NistP521
      - Gost256A
    FpeFormatV2:
      allOf:
      - type: object
        description: The second generation of Fortanix Tokenization scheme.
        properties:
          variants:
            type: array
            items:
              $ref: '#/components/schemas/FpeVariant'
            description: 'A token is accepted if it is accepted by any of these variants. Note

              tokenization results depend on the order of this list.'
          mode:
            $ref: '#/components/schemas/FpeTokenizeMode'
          input_processing:
            $ref: '#/components/schemas/FpeInputProcessing'
        required:
        - variants
    AccountExtension:
      allOf:
      - type: object
        properties:
          acct_id:
            type: string
            format: uuid
          cryptographic_policy:
            $ref: '#/components/schemas/CryptographicPolicy'
          key_history_policy:
            $ref: '#/components/schemas/KeyHistoryPolicy'
          key_metadata_policy:
            $ref: '#/components/schemas/KeyMetadataPolicy'
          custom_metadata:
            type: object
            additionalProperties:
              type: string
          custom_metadata_attributes:
            type: object
            additionalProperties:
              $ref: '#/components/schemas/CustomAttributeSearchMetadata'
          plugin_code_signing_policy:
            $ref: '#/components/schemas/PluginCodeSigningPolicy'
          mark_key_disabled_when_deactivated:
            type: boolean
        required:
        - acct_id
        - custom_metadata
        - custom_metadata_attributes
        - mark_key_disabled_when_deactivated
    DesOptionsPolicy:
      allOf:
      - type: object
        properties:
          random_iv:
            type:
            - boolean
            - 'null'
    FpeWordsIntegerRanges:
      allOf:
      - type: object
        description: 'A union of positive integer ranges.


          ```plain

          Examples: [[0, 400], [402, 1000]]

          = {0000, 0001, ..., 0400, 0402, ..., 1000}


          [[1,3], [49, 50]] with optional padding of length 8

          = {00000001, 00000002, 00000003, 00000049, 00000050}

          (accepts 1, 01, 00002, 49, 000050, etc)

          ```'
        properties:
          ranges:
            type: array
            items:
              type: array
              items:
                type: integer
              minItems: 2
              maxItems: 2
          padding_required:
            type: boolean
            description: 'If this field is true, this set accepts only numeric strings

              padded to the length given by the maximum integer in the range

              set.'
        required:
        - ranges
        - padding_required
    RsaSignaturePaddingPolicy:
      description: RSA signature padding policy.
      oneOf:
      - title: RsaSignaturePaddingPolicyVariantPss
        type: object
 

# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fortanix/refs/heads/main/openapi/fortanix-account-extensions-api-openapi.yml