Fortanix Apps API

openapi: 3.2.0
info:
  title: Fortanix DSM REST Apps API
  description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update."
  termsOfService: https://fortanix.com/legal/agreements-and-standard-terms
  contact:
    name: Fortanix Support
    url: https://support.fortanix.com/
    email: support@fortanix.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 0.1.0-20260710
servers:
- url: '{dsmEndpoint}'
  description: DSM Endpoint
  variables:
    dsmEndpoint:
      default: https://amer.smartkey.io
      description: Type your DSM server URL here (include https://)
tags:
- name: Apps
paths:
  /sys/v1/apps/{app_id}/groups:
    post:
      operationId: AddGroupMembership
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Assign the app a new group membership
      description: Assign the app a new group membership
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateGroupMembership'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppGroupMembership'
    get:
      operationId: GetAllGroupMemberships
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get all group memberships for the app
      description: Get all group memberships for the app
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/GetGroupsParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAppGroupMemberships'
  /sys/v1/apps:
    post:
      operationId: CreateApp
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Create a new application with the specified properties.
      description: Create a new application with the specified properties.
      parameters:
      - $ref: '#/components/parameters/GetAppParams'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/App'
    get:
      operationId: ListApps
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get details of all apps accessible to requester.
      description: Get details of all apps accessible to requester.
      parameters:
      - $ref: '#/components/parameters/ListAppsParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAppsResponse'
  /sys/v1/apps/{app_id}:
    delete:
      operationId: DeleteApp
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Delete an app.
      description: Delete an app.
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
    get:
      operationId: GetApp
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Lookup an application.
      description: Lookup an application.
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/GetAppParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/App'
    patch:
      operationId: UpdateApp
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Update app settings like groups, client config, etc.
      description: Update app settings like groups, client config, etc.
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/GetAppParams'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/App'
  /sys/v1/apps/{app_id}/groups/{group_id}:
    delete:
      operationId: DeleteGroupMembership
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Remove an app's membership in a specific group
      description: Remove an app's membership in a specific group
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
    get:
      operationId: GetGroupMembership
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get an app's group membership
      description: Get an app's group membership
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppGroupMembership'
    patch:
      operationId: UpdateGroupMembership
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Update an app's particular group membership
      description: Update an app's particular group membership
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GroupMembershipRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppGroupMembership'
  /sys/v1/apps/{app_id}/credential:
    get:
      operationId: GetAppCredential
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get an application's credential.
      description: 'In FIPS mode this secret will be reset after 100 failed API key authentication

        attempts in a 24 hour period.'
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppCredentialResponse'
  /sys/v1/apps/client_configs:
    get:
      operationId: GetClientConfigs
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get configurations for various clients. This API can only be called by apps
      description: 'Client configurations can be set at account level, group level or app level.

        Client config set on the app itself overrides config set at group level and

        similarly group level config overrides account level config. This API returns

        the combined client config according to the above explanation.'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientConfigurations'
  /sys/v1/apps/{app_id}/reset_secret:
    post:
      operationId: ResetAppSecret
      tags:
      - Apps
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Regenerate API key.
      description: 'This will invalidate all existing sessions of this app. Although,

        if `credential_migration_period` is set in request, previous

        credentials (or its sessions) won''t invalidate until the given time.'
      parameters:
      - name: app_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/GetAppParams'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppResetSecretRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/App'
components:
  schemas:
    ClientFileLogging:
      oneOf:
      - $ref: '#/components/schemas/ClientFileLoggingVariantEnabled'
      - $ref: '#/components/schemas/ClientFileLoggingVariantDisabled'
      discriminator:
        propertyName: mode
        mapping:
          enabled: ClientFileLoggingVariantEnabled
          disabled: ClientFileLoggingVariantDisabled
    SigningKeysVariantStored:
      allOf:
      - type: object
        properties:
          kind:
            type: string
            enum:
            - stored
        required:
        - kind
      - $ref: '#/components/schemas/SigningKeysStored'
    PreviousCredential:
      allOf:
      - type: object
        description: Expired app-credentials that are still valid for a transitional period.
        properties:
          credential:
            $ref: '#/components/schemas/AppCredential'
          valid_until:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
            description: Validity period of the App credentials.
        required:
        - credential
        - valid_until
    ApiPath:
      allOf:
      - type: object
        properties:
          api_path:
            type: string
          method:
            type: string
          context:
            $ref: '#/components/schemas/TepKeyContext'
          key_path:
            type: string
        required:
        - api_path
        - method
        - context
        - key_path
    GoogleAccessReason:
      description: An access reason provided by Google when making EKMS API calls.
      type: string
      enum:
      - REASON_UNSPECIFIED
      - CUSTOMER_INITIATED_SUPPORT
      - GOOGLE_INITIATED_SERVICE
      - THIRD_PARTY_DATA_REQUEST
      - GOOGLE_INITIATED_REVIEW
      - CUSTOMER_INITIATED_ACCESS
      - GOOGLE_INITIATED_SYSTEM_OPERATION
      - REASON_NOT_EXPECTED
      - MODIFIED_CUSTOMER_INITIATED_ACCESS
      - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION
      - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
      - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING
    AppRole:
      description: App's role.
      type: string
      enum:
      - admin
      - crypto
    CipherMode:
      description: Cipher mode used for symmetric key algorithms.
      type: string
      enum:
      - ECB
      - CBC
      - CBCNOPAD
      - CFB
      - OFB
      - CTR
      - GCM
      - CCM
      - KW
      - KWP
      - FF1
    CountAccuracy:
      description: An indicator of how accurate a count of objects is.
      oneOf:
      - $ref: '#/components/schemas/CountAccuracyVariantExact'
      - $ref: '#/components/schemas/CountAccuracyVariantApproximate'
      discriminator:
        propertyName: $type
        mapping:
          Exact: CountAccuracyVariantExact
          Approximate: CountAccuracyVariantApproximate
    GoogleAccessReasonPolicy:
      allOf:
      - type: object
        description: 'Policy specifying acceptable access reasons

          by Google Service Account at App or Sobject level.'
        properties:
          allow:
            type: array
            uniqueItems: true
            items:
              $ref: '#/components/schemas/GoogleAccessReason'
            description: Set of allowed Google Access reasons.
          allow_missing_reason:
            type: boolean
            description: Accept incoming requests which do not specify any access reasons.
        required:
        - allow
        - allow_missing_reason
    CommonClientConfig:
      allOf:
      - type: object
        properties:
          retry_timeout_millis:
            type:
            - integer
            - 'null'
          cache_ttl:
            type:
            - integer
            - 'null'
          log:
            $ref: '#/components/schemas/ClientLogConfig'
          h2_num_connections:
            type:
            - integer
            - 'null'
          quorum_approval:
            $ref: '#/components/schemas/QuorumApprovalConfig'
    RemovableKmipClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/KmipClientConfig'
    AppSort:
      oneOf:
      - title: AppSortVariantByAppId
        type: object
        description: Sort apps on the basis of their app_id.
        properties:
          sort:
            type: string
            pattern: ^app_id:(?:asc|desc)$
            example: app_id:asc
          start:
            type: string
            format: uuid
            description: Starting from a particular app_id.
        required:
        - sort
      - title: AppSortVariantByAppName
        type: object
        description: Sort apps on the basis of their app_name.
        properties:
          sort:
            type: string
            pattern: ^app_name:(?:asc|desc)$
            example: app_name:asc
          start:
            type: string
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
            description: Starting from a particular app_name.
        required:
        - sort
    SigningKeysStored:
      allOf:
      - type: object
        properties:
          keys:
            type: object
            additionalProperties:
              type: string
              format: byte
            description: Mapping key ids to DER-encoded public key.
        required:
        - keys
    GetAppGroupMemberships:
      allOf:
      - type: object
        description: The response for the GetAllGroupMembership endpoint
        properties:
          metadata:
            $ref: '#/components/schemas/GroupMetaData'
          items:
            type: array
            items:
              $ref: '#/components/schemas/AppGroupMembership'
            description: The collection of group memberships the entity is a member in
        required:
        - metadata
        - items
    TrustedCaCredential:
      allOf:
      - type: object
        description: '`TrustedCa` app auth configuration.'
        properties:
          check_revocation:
            type:
            - boolean
            - 'null'
            description: 'When `true`, revocation status of certificates is checked, and revoked

              certificates are rejected'
      - $ref: '#/components/schemas/TrustAnchorSubject'
      - $ref: '#/components/schemas/TrustAnchor'
    SecretCredentialRequest:
      oneOf:
      - type: string
        description: Use the existing secret (note that this must match the existing secret configured on the app)
      - $ref: '#/components/schemas/SecretCredentialRequestGenerate'
    TepKeyMapList:
      allOf:
      - type: array
        items:
          $ref: '#/components/schemas/TepKeyMap'
    AppAuthType:
      allOf:
      - type: object
        properties:
          auth_type:
            $ref: '#/components/schemas/AppAuthTypeVariants'
          auth_type_all:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/OneAppAuthType'
            description: 'If `auth_type` is `all`, this field will include the list of individual auth

              types for the app'
        required:
        - auth_type
    AppGroupRoleDescriptorVariantSystemDefined:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - SystemDefined
          value:
            $ref: '#/components/schemas/AppGroupRole'
        required:
        - $type
        - value
    GetGroupsParams:
      allOf:
      - type: object
        properties:
          limit:
            type: integer
          filter:
            type: string
            description: 'If specified, only groups matching this `filter` are returned.


              The following fields can be referenced in the filter:

              - `name`

              - `created_at`

              - `description`

              - `wrapping_key_name`'
          offset:
            type: integer
            description: Number of groups to skip
          continuation_token:
            type: string
            description: 'Continuation token to continue getting results. It must be the same

              token returned from the backend from a previous call, or empty.


              Existence of this query parameter controls the response (and the backend behavior):

              - If specified (including an empty value), the backend returns metadata alongside

              the collection of groups. The metadata will potentially contain a fresh `continuation_token`.


              Note: If there is a `limit` specified in the request and DSM returns `limit`-many items in the

              response, it will still include a fresh continuation token if there are more items in the collection.

              Additionally, unlike other query parameters, `limit` is not required to remain unchanged in a chain of

              requests with `continuation_token`s.

              - If omitted, the backend returns just a collection of groups with no metadata.'
      - $ref: '#/components/schemas/GroupSort'
    TepKeyMap:
      allOf:
      - type: object
        properties:
          path:
            $ref: '#/components/schemas/ApiPath'
          kid:
            type: string
            format: uuid
          mode:
            $ref: '#/components/schemas/CipherMode'
        required:
        - path
        - kid
        - mode
    AppOauthConfigVariantDisabled:
      allOf:
      - type: object
        properties:
          state:
            type: string
            enum:
            - disabled
        required:
        - state
      - type: object
        properties: {}
    LastAppOperationTimestamp:
      allOf:
      - type: object
        properties:
          generic:
            type:
            - integer
            - 'null'
          tokenization:
            type:
            - integer
            - 'null'
          tep:
            type:
            - integer
            - 'null'
          accelerator:
            type:
            - integer
            - 'null'
          secrets_management:
            type:
            - integer
            - 'null'
    AppCredentialRequest:
      oneOf:
      - title: AppCredentialRequestVariantAll
        type: object
        properties:
          all:
            type: array
            items:
              $ref: '#/components/schemas/OneAppCredentialRequest'
            description: 'Using `all`, clients can specify a combination of two credentials:

              - one must be a mutual TLS credential (either `certificate` or `trustedca`),

              - the other must be a general app credential (one of `secret`, `awsiam`, `signedjwt`, or `ldap`)


              Apps authenticating with this variant must present both forms of credentials,

              i.e., they must present a client certificate during TLS handshake, and also

              present the other form of credential in the HTTP request.'
        required:
        - all
      - $ref: '#/components/schemas/OneAppCredentialRequest'
    CreateGroupMembership:
      allOf:
      - type: object
        description: Request for assigning a group membership to an (AppRole::Admin) app.
        properties:
          group_id:
            type: string
            format: uuid
            description: The id of the target group
          membership:
            $ref: '#/components/schemas/AppGroupMembership'
        required:
        - group_id
        - membership
    ClientConfigurationsRequest:
      allOf:
      - type: object
        properties:
          common:
            $ref: '#/components/schemas/RemovableCommonClientConfig'
          pkcs11:
            $ref: '#/components/schemas/RemovablePkcs11ClientConfig'
          kmip:
            $ref: '#/components/schemas/RemovableKmipClientConfig'
          tep:
            $ref: '#/components/schemas/RemovableTepClientConfig'
    AppCredential:
      oneOf:
      - title: AppCredentialVariantAll
        type: object
        properties:
          all:
            type: array
            items:
              $ref: '#/components/schemas/OneAppCredential'
        required:
        - all
      - $ref: '#/components/schemas/OneAppCredential'
    AppAccountRole:
      type: string
      enum:
      - AccountAdministrator
      - AccountMember
      - AccountAuditor
    SecretCredentialRequestGenerate:
      allOf:
      - type: object
        description: Generate a new secret
        properties:
          size:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 4294967295
            description: Size of the secret to be generated in bytes
    GoogleServiceAccountCredential:
      allOf:
      - type: object
        properties:
          access_reason_policy:
            $ref: '#/components/schemas/GoogleAccessReasonPolicy'
          groups:
            type:
            - object
            - 'null'
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/GcpAppPermissions'
            description: Mapping for all groups an application is part of and the Gcp specific permissions it has within each of those groups.
    AppAccountRoleDescriptor:
      oneOf:
      - $ref: '#/components/schemas/AppAccountRoleDescriptorVariantSystemDefined'
      - $ref: '#/components/schemas/AppAccountRoleDescriptorVariantCustom'
      discriminator:
        propertyName: $type
        mapping:
          SystemDefined: AppAccountRoleDescriptorVariantSystemDefined
          Custom: AppAccountRoleDescriptorVariantCustom
    GroupSort:
      oneOf:
      - title: GroupSortVariantByGroupId
        type: object
        properties:
          sort_by:
            type: string
            pattern: ^group_id:(?:asc|desc)$
            example: group_id:asc
          previous_id:
            type: string
            format: uuid
        required:
        - previous_id
      - title: GroupSortVariantByGroupName
        type: object
        properties:
          sort_by:
            type: string
            pattern: ^group_name:(?:asc|desc)$
            example: group_name:asc
          previous_sort_value:
            type: string
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
        required:
        - previous_sort_value
    GroupMetaData:
      allOf:
      - type: object
        description: 'Additional information or context regarding the groups the entity

          holds membership in'
        properties:
          all_groups:
            type: boolean
            description: Whether the entity has been assigned an exclusive "all groups role"
        required:
        - all_groups
    CountAccuracyVariantExact:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Exact
        required:
        - $type
      - type: object
        properties: {}
    TepSchemaVariantOpenAPI:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - OpenAPI
        required:
        - $type
      - type: object
        properties:
          openapi:
            type: string
    KeyOpsOverride:
      allOf:
      - type: object
        properties:
          add_key_ops:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/KeyOperations'
            description: 'The operations to add to any key creation request (only supported in KMIP).


              The following operations can be specified:

              - `EXPORT`

              - `APPMANAGEABLE`

              - `HIGHVOLUME`


              The operations specified cannot conflict with what''s specified in the

              `key_ops` field of account and/or group policies (where applicable).


              **Note**: This is only enforced on (KMIP) creation requests since we assume

              updates removing key operations are intentional.'
    SigningKeys:
      description: 'Signing keys used to validate JSON Web Signature objects including signed

        JSON Web Tokens.'
      oneOf:
      - $ref: '#/components/schemas/SigningKeysVariantStored'
      - $ref: '#/components/schemas/SigningKeysVariantFetched'
      discriminator:
        propertyName: kind
        mapping:
          stored: SigningKeysVariantStored
          fetched: SigningKeysVariantFetched
    PrivateClaimsPolicy:
      allOf:
      - type: object
        properties:
          definition:
            $ref: '#/components/schemas/PolicyDefinition'
        required:
        - definition
    TepSchema:
      oneOf:
      - $ref: '#/components/schemas/TepSchemaVariantOpenAPI'
      discriminator:
        propertyName: $type
        mapping:
          OpenAPI: TepSchemaVariantOpenAPI
    AwsXksCredential:
      allOf:
      - type: object
        properties:
          access_key_id:
            type: string
          secret_key:
            type: string
        required:
        - access_key_id
        - secret_key
    IpAddressPolicy:
      description: The IPs that are allowed for an application. ipv4 or ipv6 both are acceptable types.
      oneOf:
      - title: IpAddressPolicyVariantAllowAll
        type: string
        enum:
        - allow_all
      - title: IpAddressPolicyVariantWhitelist
        type: object
        properties:
          whitelist:
            type: array
            uniqueItems: true
            items:
              type: string
        required:
        - whitelist
    TepKeyContext:
      type: string
      enum:
      - request
      - response
    ObjectTypeFilterSelection:
      allOf:
      - type: object
        properties:
          selection:
            type: array
            items:
              $ref: '#/components/schemas/ObjectType'
        required:
        - selection
    AwsXksCredentialRequest:
      allOf:
      - type: object
        properties:
          access_key_id:
            type:
            - string
            - 'null'
          secret_key:
            type: string
    CollectionMetadata:
      allOf:
      - type: object
        properties:
          continuation_token:
            type:
            - string
            - 'null'
            description: 'Continuation token to continue getting results. If the response contains a continuation_token,

              the results returned are partial. In that case, the client can make the same request with this

              continuation token to continue getting results.'
      - $ref: '#/components/schemas/ObjectCount'
    RemovablePkcs11ClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/Pkcs11ClientConfig'
    OneAppAuthType:
      description: Authentication method of an app.
      type: string
      enum:
      - Secret
      - GoogleServiceAccount
      - SignedJwt
      - Ldap
      - AwsIam
      - AwsXks
      - GoogleWorkspaceCSE
      - Certificate
      - TrustedCa
    ClientLogConfig:
      allOf:
      - type: object
        properties:
          system:
            type:
            - boolean
            - 'null'
          file:
            $ref: '#/components/schemas/ClientFileLogging'
          level:
            type:
            - string
            - 'null'
    RemovableCommonClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/CommonClientConfig'
    TrustAnchorSubject:
      description: 'Subjects or subject alternative names (SANs) for trusted CA auth.

        DSM will check the subject field and any SANs inside incoming

        client certificates and compare them against the subjects configured

        in the trusted CA auth config.'
      oneOf:
      - title: TrustAnchorSubjectVariantSubject
        type: object
        properties:
          subject:
            type: array
            items:
              type: array
              minItems: 2
              maxItems: 2
              items:
                type: string
            description: 'A single subject as a list of OID/value string pairs

              (representing a sequence of relative distinguished names), which

              should appear in the client cert''s subject field and/or as one

              of its SANs.


              This legacy variant is retained for backcompat purposes, and is

              equivalent to specifying a directoryName via the SubjectGeneral

              variant.'
        required:
        - subject
      - title: TrustAnchorSubjectVariantSubjectGeneral
        type: object
        properties:
          subject_general:
            $ref: '#/components/schemas/SubjectGeneral'
        required:
        - subject_general
      - title: TrustAnchorSubjectVariantSubjects
        type: object
        properties:
          subjects:
            type: array
            items:
              $ref: '#/components/schemas/SubjectGeneral'
            description: 'List of allowed GeneralName subjects. At least one of the values

              in this list must appear in the client cert, under its subject

              field and/or as one of its SANs.


              Currently, DSM supports at most 16 subjects.'
        required:
        - subjects
    TepClientConfig:
      allOf:
      - type: object
        properties:
          schema:
            $ref: '#/components/schemas/TepSchema'
          key_map:
            $ref: '#/components/schemas/TepKeyMapList'
        required:
        - schema
        - key_map
    PrincipalUserViaApp:
      allOf:
      - type: object
        description: UserViaApp signifies a user authorizing some app to act on its behalf through OAuth.
        properties:
          user_id:
            type: string
            format: uuid
          scopes:
            type: array
   

# --- truncated at 32 KB (67 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fortanix/refs/heads/main/openapi/fortanix-apps-api-openapi.yml