Fortanix Groups API

openapi: 3.2.0
info:
  title: Fortanix DSM REST Groups API
  description: "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients. \n- PATCH requests accept a JSON value describing a partial update to the specified resource. All top-level fields in the PATCH request are optional. If an optional field is omitted, the existing value of that field is preserved. In general, for nested JSON objects, the request must provide the complete object value rather than a partial update."
  termsOfService: https://fortanix.com/legal/agreements-and-standard-terms
  contact:
    name: Fortanix Support
    url: https://support.fortanix.com/
    email: support@fortanix.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 0.1.0-20260710
servers:
- url: '{dsmEndpoint}'
  description: DSM Endpoint
  variables:
    dsmEndpoint:
      default: https://amer.smartkey.io
      description: Type your DSM server URL here (include https://)
tags:
- name: Groups
paths:
  /sys/v1/groups/{group_id}/hmg/scans:
    post:
      operationId: AsyncScanHmg
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Scan external objects asynchronously.
      description: 'Scan external objects asynchronously and create corresponding

        virtual sobjects in the group as needed. If there is already a virtual

        sobject corresponding to a scanned object, no sobject is created.

        This is only supported for DSM-backed groups currently.'
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scan'
    get:
      operationId: GetAllHmgScans
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Retrieve the scan status of an external group.
      description: Retrieve the scan status of an external group.
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAllHmgScansResponse'
  /sys/v1/groups/{group_id}/hmg/check:
    post:
      operationId: CheckHmg
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Check that the HMG configuration for a particular group is

        valid and reachable.'
      description: 'Check that the HMG configuration for a particular group is

        valid and reachable.'
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckHmgRequest'
      responses:
        '204':
          description: Nothing is returned on success
  /sys/v1/groups/hmg/check:
    post:
      operationId: CheckHmgConfig
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Check that the HMG configuration provided is valid and reachable.
      description: Check that the HMG configuration provided is valid and reachable.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HmgConfig'
      responses:
        '204':
          description: Nothing is returned on success
  /sys/v1/groups:
    post:
      operationId: CreateGroup
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Create a new group with the specified properties.
      description: Create a new group with the specified properties.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GroupRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
    get:
      operationId: ListGroups
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Get all groups accessible to the requester.
      description: Get all groups accessible to the requester.
      parameters:
      - $ref: '#/components/parameters/GetGroupsParams'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListGroupsResponse'
  /sys/v1/groups/{group_id}:
    delete:
      operationId: DeleteGroup
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Delete the group.
      description: Delete the group.
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '204':
          description: Nothing is returned on success
    get:
      operationId: GetGroup
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Lookup a specific group.
      description: Lookup a specific group.
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
    patch:
      operationId: UpdateGroup
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Change a group's properties.
      description: Change a group's properties.
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GroupRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
  /sys/v1/groups/hmg/gcp_key_rings:
    post:
      operationId: GetGcpKeyRings
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Given an GCP configuration, fetch a list of available

        GCP key rings which can be used to back a group.'
      description: 'Given an GCP configuration, fetch a list of available

        GCP key rings which can be used to back a group.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcpKeyRingConfig'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
  /sys/v1/groups/{group_id}/hmg/scans/{scan_id}:
    get:
      operationId: GetScan
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Query the status of a particular scan. Only the last five completed

        scans,as well as any in-progress scan, is queryable.'
      description: 'Query the status of a particular scan. Only the last five completed

        scans,as well as any in-progress scan, is queryable.'
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - name: scan_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scan'
  /sys/v1/groups/hmg/azure_vaults:
    post:
      operationId: GetVaults
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: 'Given an Azure configuration, fetch a list of available

        Azure key vaults which can be used to back a group.'
      description: 'Given an Azure configuration, fetch a list of available

        Azure key vaults which can be used to back a group.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HmgConfig'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/KeyVault'
  /sys/v1/groups/hmg/scan_collections:
    post:
      operationId: ListKeyCollections
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Using the chosen credential, list the key collections available.
      description: Using the chosen credential, list the key collections available.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HmgListKeyCollectionsRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HmgListKeyCollectionsResponse'
  /sys/v1/groups/{group_id}/hmg/scan:
    post:
      operationId: ScanHmg
      tags:
      - Groups
      security:
      - bearerToken: []
      - apiKeyAuth: []
      summary: Scan external objects.
      description: 'Scan external objects synchronously and create corresponding

        virtual sobjects in the group as needed. If there is already a

        virtual sobject corresponding to a scanned object, no sobject

        is created (but the existing virtual sobject may be updated).


        Returns a list of all the newly-created sobjects.'
      parameters:
      - name: group_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScanHmgRequest'
      responses:
        2XX:
          description: Success result
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Sobject'
components:
  schemas:
    HmgConfigFortanixFipsCluster:
      allOf:
      - type: object
        properties:
          url:
            type: string
          tls:
            $ref: '#/components/schemas/TlsConfig'
          pin:
            type: string
          credentials:
            type:
            - array
            - 'null'
            items:
              type: string
          hsm_order:
            type:
            - integer
            - 'null'
            format: int32
            description: 'The priority of this `HmgConfig`. This is used when a group is

              configured with an `HmgRedundancyScheme`, and is otherwise

              unused. (See the docs for `HmgRedundancyScheme` for more

              information about the interpretation of this field.)'
        required:
        - url
        - tls
    ClientFileLogging:
      oneOf:
      - $ref: '#/components/schemas/ClientFileLoggingVariantEnabled'
      - $ref: '#/components/schemas/ClientFileLoggingVariantDisabled'
      discriminator:
        propertyName: mode
        mapping:
          enabled: ClientFileLoggingVariantEnabled
          disabled: ClientFileLoggingVariantDisabled
    FpeDate:
      description: 'A structure for specifying a token part representing a date that occurs after a specified date

        and/or occurs before a specified date. Depending on the subparts that make up the date, one of

        the three options is used.'
      oneOf:
      - title: FpeDateVariantDayMonthYear
        type: object
        properties:
          dmy_date:
            $ref: '#/components/schemas/FpeDateDayMonthYear'
        required:
        - dmy_date
      - title: FpeDateVariantMonthDay
        type: object
        properties:
          month_day_date:
            $ref: '#/components/schemas/FpeDateMonthDay'
        required:
        - month_day_date
      - title: FpeDateVariantMonthYear
        type: object
        properties:
          month_year_date:
            $ref: '#/components/schemas/FpeDateMonthYear'
        required:
        - month_year_date
    EffectiveKeyOperations:
      description: "Operations allowed to be performed on a given key by a given User or an app\n\n\n\n          SIGN:\n            If this is set, the key can be used for signing.\n\n\n          VERIFY:\n            If this is set, the key can used for verifying a signature.\n\n\n          ENCRYPT:\n            If this is set, the key can be used for encryption.\n\n\n          DECRYPT:\n            If this is set, the key can be used for decryption.\n\n\n          WRAPKEY:\n            If this is set, the key can be used wrapping other keys.\n            The key being wrapped must have the EXPORT operation enabled.\n\n\n          UNWRAPKEY:\n            If this is set, the key can be used to unwrap a wrapped key.\n\n\n          DERIVEKEY:\n            If this is set, the key can be used to derive another key.\n\n\n          TRANSFORM:\n            If this is set, the key can be transformed.\n\n\n          MACGENERATE:\n            If this is set, the key can be used to compute a cryptographic\n            Message Authentication Code (MAC) on a message.\n\n\n          MACVERIFY:\n            If they is set, the key can be used to verify a MAC.\n\n\n          EXPORT:\n            If this is set, the value of the key can be retrieved\n            with an authenticated request. This shouldn't be set unless\n            required. It is more secure to keep the key's value inside DSM only.\n\n\n          APPMANAGEABLE:\n            Without this operation, management operations like delete, destroy,\n            rotate, activate, restore, revoke, revert, update, remove_private, etc.\n            cannot be performed by a crypto App.\n            A user with access or admin app can still perform these operations.\n            This option is only relevant for crypto apps.\n\n\n          HIGHVOLUME:\n            If this is set, audit logs will not be recorded for the key.\n            High volume here tries to signify a key that is being used a lot\n            and will produce lots of logs. Setting this operation disables\n            audit logs for the key.\n\n\n          AGREEKEY:\n            If this is set, the key can be used for key agreement.\n            Both the private and public key should have this option enabled\n            to perform an agree operation.\n\n\n          ENCAPSULATE:\n            If this is set, the key can be used for key encapsulation. The\n            result is a new symmetric key and a ciphertext.\n\n\n          DECAPSULATE:\n            If this is set, the key can be used for key decapsulation. If\n            decapsulation succeeds, the result is a new symmetric key.\n\n\n          MASKDECRYPT:\n            If this is set, the key can be used for masked decryption only.\n\n"
      type: string
      enum:
      - SIGN
      - VERIFY
      - ENCRYPT
      - DECRYPT
      - WRAPKEY
      - UNWRAPKEY
      - DERIVEKEY
      - TRANSFORM
      - MACGENERATE
      - MACVERIFY
      - EXPORT
      - APPMANAGEABLE
      - HIGHVOLUME
      - AGREEKEY
      - ENCAPSULATE
      - DECAPSULATE
      - MASKDECRYPT
    GroupApprovalPolicy:
      allOf:
      - type: object
        description: Group approval policy.
        properties:
          protect_manage_operations:
            type:
            - boolean
            - 'null'
            description: 'Deprecated, left this for backward compatibility.

              When this is true, manage operations on security objects require approval.'
          protect_permissions:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/QuorumGroupPermissions'
            description: Use QuorumGroupPermissions to represent operations that require approval.
          protect_crypto_operations:
            type:
            - boolean
            - 'null'
            description: When this is true, cryptographic operations on security objects require approval.
      - $ref: '#/components/schemas/QuorumPolicy'
    ExternalKmsInfoVariantOci:
      allOf:
      - type: object
        properties:
          type:
            type: string
            enum:
            - Oci
        required:
        - type
      - $ref: '#/components/schemas/OciVaultInfo'
    WrappingKeyName:
      oneOf:
      - type:
        - string
        - 'null'
        maxLength: 4096
        pattern: ^[^\n]*[^\s\n][^\n]*$
    KeyCreationMethodVariantUnwrap:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - Unwrap
        required:
        - method
      - type: object
        properties: {}
    ApiPath:
      allOf:
      - type: object
        properties:
          api_path:
            type: string
          method:
            type: string
          context:
            $ref: '#/components/schemas/TepKeyContext'
          key_path:
            type: string
        required:
        - api_path
        - method
        - context
        - key_path
    FpeDataPart:
      description: Structure for specifying (part of) a complex tokenization data type.
      oneOf:
      - $ref: '#/components/schemas/FpeEncryptedPart'
      - $ref: '#/components/schemas/FpeDataPartLiteral'
      - $ref: '#/components/schemas/FpeCompoundPart'
    PublishPublicKeyConfigEnabled:
      allOf:
      - type: object
        properties:
          list_previous_version:
            type: boolean
            description: Additionally list the previous version of the key if not compromised.
        required:
        - list_previous_version
    GoogleAccessReason:
      description: An access reason provided by Google when making EKMS API calls.
      type: string
      enum:
      - REASON_UNSPECIFIED
      - CUSTOMER_INITIATED_SUPPORT
      - GOOGLE_INITIATED_SERVICE
      - THIRD_PARTY_DATA_REQUEST
      - GOOGLE_INITIATED_REVIEW
      - CUSTOMER_INITIATED_ACCESS
      - GOOGLE_INITIATED_SYSTEM_OPERATION
      - REASON_NOT_EXPECTED
      - MODIFIED_CUSTOMER_INITIATED_ACCESS
      - MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION
      - GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
      - CUSTOMER_AUTHORIZED_WORKFLOW_SERVICING
    Slip10Options:
      allOf:
      - type: object
        properties:
          derivation_path:
            type: array
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
            description: 'The Slip10 path, starting from master. Master key is [].


              Ex: m/42/42''/0 -> [42, 2**31 + 42, 0]'
        required:
        - derivation_path
    CipherMode:
      description: Cipher mode used for symmetric key algorithms.
      type: string
      enum:
      - ECB
      - CBC
      - CBCNOPAD
      - CFB
      - OFB
      - CTR
      - GCM
      - CCM
      - KW
      - KWP
      - FF1
    CountAccuracy:
      description: An indicator of how accurate a count of objects is.
      oneOf:
      - $ref: '#/components/schemas/CountAccuracyVariantExact'
      - $ref: '#/components/schemas/CountAccuracyVariantApproximate'
      discriminator:
        propertyName: $type
        mapping:
          Exact: CountAccuracyVariantExact
          Approximate: CountAccuracyVariantApproximate
    TlsConfigVariantOpportunistic:
      allOf:
      - type: object
        properties:
          mode:
            type: string
            enum:
            - opportunistic
        required:
        - mode
      - type: object
        properties: {}
    GoogleAccessReasonPolicy:
      allOf:
      - type: object
        description: 'Policy specifying acceptable access reasons

          by Google Service Account at App or Sobject level.'
        properties:
          allow:
            type: array
            uniqueItems: true
            items:
              $ref: '#/components/schemas/GoogleAccessReason'
            description: Set of allowed Google Access reasons.
          allow_missing_reason:
            type: boolean
            description: Accept incoming requests which do not specify any access reasons.
        required:
        - allow
        - allow_missing_reason
    FpeDayMonthDate:
      allOf:
      - type: object
        description: 'A structure for specifying a particular date consisting of a day and a month, for use in an

          FpeDate structure.'
        properties:
          month:
            type: integer
            minimum: 0
            maximum: 255
            description: The month, which should be an integer from 1 to 12.
          day:
            type: integer
            minimum: 0
            maximum: 255
            description: 'The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month

              and year. Here, February is treated as having 29 days.'
        required:
        - month
        - day
    FpeInputProcessing:
      description: Options to apply some pre- and post-processing to the input.
      oneOf:
      - title: FpeInputProcessingVariantStripUnknown
        type: string
        enum:
        - strip_unknown
      - title: FpeInputProcessingVariantPassthroughUnknown
        type: string
        enum:
        - passthrough_unknown
      - title: FpeInputProcessingVariantPassthroughSpecific
        type: object
        properties:
          passthrough_specific:
            $ref: '#/components/schemas/FpeInputProcessingPassthroughSpecific'
        required:
        - passthrough_specific
    CommonClientConfig:
      allOf:
      - type: object
        properties:
          retry_timeout_millis:
            type:
            - integer
            - 'null'
          cache_ttl:
            type:
            - integer
            - 'null'
          log:
            $ref: '#/components/schemas/ClientLogConfig'
          h2_num_connections:
            type:
            - integer
            - 'null'
          quorum_approval:
            $ref: '#/components/schemas/QuorumApprovalConfig'
    RemovableKmipClientConfig:
      oneOf:
      - type: string
        enum:
        - remove
      - $ref: '#/components/schemas/KmipClientConfig'
    CertificateOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    Des3OptionsPolicy:
      allOf:
      - type: object
        description: 'Cryptographic policy for triple DES objects. Setting `key_sizes: [168]`

          forbids two-key triple DES.'
        properties:
          key_sizes:
            type:
            - array
            - 'null'
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
          random_iv:
            type:
            - boolean
            - 'null'
    PublishPublicKeyConfig:
      description: If enabled, the public key will be available publicly (without authentication) through the GetPublicKey API.
      oneOf:
      - $ref: '#/components/schemas/PublishPublicKeyConfigVariantEnabled'
      - $ref: '#/components/schemas/PublishPublicKeyConfigVariantDisabled'
      discriminator:
        propertyName: state
        mapping:
          enabled: PublishPublicKeyConfigVariantEnabled
          disabled: PublishPublicKeyConfigVariantDisabled
    CheckHmgRequest:
      allOf:
      - type: object
        properties:
          id:
            type:
            - string
            - 'null'
            format: uuid
            description: The ID of the hmg configuration in the group.
          config:
            $ref: '#/components/schemas/HmgConfig'
    AriaOptions:
      allOf:
      - type: object
        properties:
          key_sizes:
            type:
            - array
            - 'null'
            items:
              type: integer
              minimum: 0
              maximum: 4294967295
          tag_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 255
          cipher_mode:
            $ref: '#/components/schemas/CipherMode'
          random_iv:
            type:
            - boolean
            - 'null'
          iv_length:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 255
    ScanResultVariantFailed:
      allOf:
      - type: object
        properties:
          $type:
            type: string
            enum:
            - Failed
        required:
        - $type
      - $ref: '#/components/schemas/ScanResultFailed'
    KeyCreationMethodVariantImport:
      allOf:
      - type: object
        properties:
          method:
            type: string
            enum:
            - Import
        required:
        - method
      - type: object
        properties: {}
    FpeInputProcessingPassthroughSpecific:
      allOf:
      - type: object
        properties:
          passthrough:
            type: array
            uniqueItems: true
            items:
              type: string
              minLength: 1
              maxLength: 1
          other:
            $ref: '#/components/schemas/FpeInputDefaultProcessing'
        required:
        - passthrough
        - other
    OciVaultInfo:
      allOf:
      - type: object
        description: 'Any key specific metadata that isn''t already described

          by an existing security object field.'
        properties:
          protection_mode:
            type: string
            description: 'Describes the OCI vault protection mode, usually

              meaning HSM or SOFTWARE.'
          deletion_date:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
            description: The scheduled deletion_date of the OCI key version
          display_name:
            type: string
            maxLength: 4096
            pattern: ^[^\n]*[^\s\n][^\n]*$
            description: 'The name in the OCI Vault (and may differ from

              what the DSM virtual key shows).'
        required:
        - protection_mode
        - display_name
    TepKeyMapList:
      allOf:
      - type: array
        items:
          $ref: '#/components/schemas/TepKeyMap'
    HmgConfigVariantFortanix:
      allOf:
      - type: object
        properties:
          kind:
            type: string
            enum:
            - Fortanix
        required:
        - kind
      - $ref: '#/components/schemas/HmgConfigFortanix'
    ApprovalAuthConfig:
      allOf:
      - type: object
        description: Authentication requirements for approval request reviewers.
        properties:
          require_password:
            type:
            - boolean
            - 'null'
          require_2fa:
            type:
            - boolean
            - 'null'
    LmsOptionsPolicy:
      allOf:
      - type: object
        properties: {}
    HmgConfigVariantFortanixFipsCluster:
      allOf:
      - type: object
        properties:
          kind:
            type: string
            enum:
            - FortanixFipsCluster
        required:
        - kind
      - $ref: '#/components/schemas/HmgConfigFortanixFipsCluster'
    PublishPublicKeyConfigVariantEnabled:
      allOf:
      - type: object
        properties:
          state:
            type: string
            enum:
            - enabled
        required:
        - state
      - $ref: '#/components/schemas/PublishPublicKeyConfigEnabled'
    AutoScanSettings:
      allOf:
      - type: object
        description: Settings for automatic scanning in DSM-backed groups or replication accounts.
        properties:
          scan_interval_hours:
            type: integer
            minimum: 0
            maximum: 255
            description: The number of hours between successive automatic scans. Must be greater than 0.
        required:
        - scan_interval_hours
    RotationPolicy:
      allOf:
      - type: object
        properties:
          effective_at:
            type: string
            pattern: ^\d{4}\d{2}\d{2}T\d{2}\d{2}\d{2}Z$
            example: 20170509T070912Z
          deactivate_rotated_key:
            type:
            - boolean
            - 'null'
          rotate_copied_keys:
            $ref: '#/components/schemas/RotateCopiedKeys'
      - $ref: '#/components/schemas/RotationInterval'
    FpeConstraints:
      allOf:
      - type: object
        description: Constraints on a portion of a complex tokenization data type.
        properties:
          luhn_check:
            type:
            - boolean
            - 'null'
            description: 'Whether the token part contains a checksum that satisfies the Luhn formula. It is an

              error to apply this constraint to non-numeric parts, or to have an encrypted part be

              under more than one Luhn check constraint. Also, if an encrypted part has a Luhn check

              constraint applied to it and may contain at least one digit that is not preserved, it

              must not specify any other constraints.'
          num_gt:
            type:
            - integer
            - 'null'
            description: 'Number that the token part should be greater than.


              This constraint can only be specified on (non-compound) numeric encrypted parts

              guaranteed to preserve either everything or nothing at all. (For example, if an

              encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the

              first five digits is not guaranteed to preserve everything, because if the input

              happens to be six or more digits long, there will be at least one digit that

              remains unpreserved.)'
          num_lt:
            type:
            - integer
            - 'null'
            description: 'Number that the token part should be smaller than.


              This constraint can only be specified on (non-compound) numeric encrypted parts

              guaranteed to preserve either everything or nothing at all. (For example, if an

              encrypted part consists of 5 to 10 digits, a `preserve` list that covers only the

              first five digits is not guaranteed to preserve everything, because if the input

              happens to be six or more digits long, there will be at least one digit that

              remains unpreserved.)'
          num_ne:
            type:
            - array
            - 'null'
            items:
              type: integer
            description: 'Numbers that the token part should not be equal to. It is an error to apply this

              constraint to non-numeric parts.'
          date:
            $ref: '#/components/schemas/FpeDateConstraint'
          applies_to:
            $ref: '#/components/schemas/FpeConstraintsApplicability'
    AwsKeyRotationStatusVariantKeyRotationEnabled:
      allOf:
      - type: object
        properties:
          type:
            type: string
            enum:
            - KeyRotationEnabled
        required:
        - type
      - $ref: '#/components/schemas/AwsKeyRotationStatusKeyRotationEnabled'
 

# --- truncated at 32 KB (151 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/fortanix/refs/heads/main/openapi/fortanix-groups-api-openapi.yml