swagger: '2.0'
info:
  title: WebApps API Client AppServiceEnvironments SiteCertificates API
  version: '2025-05-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
host: management.azure.com
schemes:
- https
consumes:
- application/json
produces:
- application/json
security:
- azure_auth:
  - user_impersonation
tags:
- name: SiteCertificates
paths:
  /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/certificates:
    get:
      operationId: SiteCertificates_List
      tags:
      - SiteCertificates
      summary: Get all certificates in a resource group under a site.
      description: Get all certificates in a resource group under a site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          schema:
            $ref: '#/definitions/CertificateCollection'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        List Certificates by resource group:
          $ref: ./examples/ListSiteCertificatesByResourceGroup.json
      x-ms-pageable:
        nextLinkName: nextLink
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/certificates/{certificateName}
  : get:
      operationId: SiteCertificates_Get
      tags:
      - SiteCertificates
      summary: Get a certificate belonging to a given site.
      description: Get a certificate belonging to a given site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          schema:
            $ref: '#/definitions/Certificate'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Get Certificate:
          $ref: ./examples/GetSiteCertificate.json
    put:
      operationId: SiteCertificates_CreateOrUpdate
      tags:
      - SiteCertificates
      summary: Create or update a certificate under a given site.
      description: Create or update a certificate under a given site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateEnvelope
        in: body
        description: Details of certificate, if it exists already.
        required: true
        schema:
          $ref: '#/definitions/Certificate'
      responses:
        '200':
          description: Resource 'Certificate' update operation succeeded
          schema:
            $ref: '#/definitions/Certificate'
        '201':
          description: Resource 'Certificate' create operation succeeded
          schema:
            $ref: '#/definitions/Certificate'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Create Or Update Certificate:
          $ref: ./examples/CreateOrUpdateSiteCertificate.json
    patch:
      operationId: SiteCertificates_Update
      tags:
      - SiteCertificates
      summary: Create or update a certificate under a given site.
      description: Create or update a certificate under a given site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateEnvelope
        in: body
        description: Details of certificate, if it exists already.
        required: true
        schema:
          $ref: '#/definitions/CertificatePatchResource'
      responses:
        '200':
          description: Azure operation completed successfully.
          schema:
            $ref: '#/definitions/Certificate'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Patch Certificate:
          $ref: ./examples/PatchSiteCertificate.json
    delete:
      operationId: SiteCertificates_Delete
      tags:
      - SiteCertificates
      summary: Delete a certificate from the site.
      description: Delete a certificate from the site.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Delete Certificate:
          $ref: ./examples/DeleteSiteCertificate.json
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/certificates
  : get:
      operationId: SiteCertificates_ListSlot
      tags:
      - SiteCertificates
      summary: Get all certificates in a resource group for a given site and a deployment slot.
      description: Get all certificates in a resource group for a given site and a deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          schema:
            $ref: '#/definitions/CertificateCollection'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        List Certificates by resource group for a slot:
          $ref: ./examples/ListSiteCertificatesByResourceGroupSlot.json
      x-ms-pageable:
        nextLinkName: nextLink
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}/slots/{slot}/certificates/{certificateName}
  : get:
      operationId: SiteCertificates_GetSlot
      tags:
      - SiteCertificates
      summary: Get a certificate for a given site and deployment slot.
      description: Get a certificate for a given site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Azure operation completed successfully.
          schema:
            $ref: '#/definitions/Certificate'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Get Site Certificate for a slot:
          $ref: ./examples/GetSiteCertificateSlot.json
    put:
      operationId: SiteCertificates_CreateOrUpdateSlot
      tags:
      - SiteCertificates
      summary: Create or update a certificate in a given site and deployment slot.
      description: Create or update a certificate in a given site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateEnvelope
        in: body
        description: Details of certificate, if it exists already.
        required: true
        schema:
          $ref: '#/definitions/Certificate'
      responses:
        '200':
          description: Resource 'Certificate' update operation succeeded
          schema:
            $ref: '#/definitions/Certificate'
        '201':
          description: Resource 'Certificate' create operation succeeded
          schema:
            $ref: '#/definitions/Certificate'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Create Or Update Certificate for slot:
          $ref: ./examples/CreateOrUpdateSiteCertificateSlot.json
    patch:
      operationId: SiteCertificates_UpdateSlot
      tags:
      - SiteCertificates
      summary: Create or update a certificate for a site and deployment slot.
      description: Create or update a certificate for a site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: certificateEnvelope
        in: body
        description: Details of certificate, if it exists already.
        required: true
        schema:
          $ref: '#/definitions/CertificatePatchResource'
      responses:
        '200':
          description: Azure operation completed successfully.
          schema:
            $ref: '#/definitions/Certificate'
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Patch Certificate for slot:
          $ref: ./examples/PatchSiteCertificateSlot.json
    delete:
      operationId: SiteCertificates_DeleteSlot
      tags:
      - SiteCertificates
      summary: Delete a certificate for a given site and deployment slot.
      description: Delete a certificate for a given site and deployment slot.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: name
        in: path
        description: Name of the site.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      - name: slot
        in: path
        description: Name of the deployment slot. If a slot is not specified, the API will create a binding for the production slot.
        required: true
        type: string
      - name: certificateName
        in: path
        description: Name of the certificate.
        required: true
        type: string
        pattern: ^[A-z][A-z0-9]*$
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          schema:
            $ref: '#/definitions/DefaultErrorResponse'
      x-ms-examples:
        Delete Certificate for slot:
          $ref: ./examples/DeleteSiteCertificateSlot.json
definitions:
  KeyVaultSecretStatus:
    type: string
    description: Status of the Key Vault secret.
    enum:
    - Initialized
    - WaitingOnCertificateOrder
    - Succeeded
    - CertificateOrderFailed
    - OperationNotPermittedOnKeyVault
    - AzureServiceUnauthorizedToAccessKeyVault
    - KeyVaultDoesNotExist
    - KeyVaultSecretDoesNotExist
    - UnknownError
    - ExternalPrivateKey
    - Unknown
    x-ms-enum:
      name: KeyVaultSecretStatus
      modelAsString: false
  DefaultErrorResponse:
    type: object
    description: App Service error response.
    properties:
      error:
        $ref: '#/definitions/DefaultErrorResponseError'
        description: Error model.
        readOnly: true
  HostingEnvironmentProfile:
    type: object
    description: Specification for an App Service Environment to use for this resource.
    properties:
      id:
        type: string
        description: Resource ID of the App Service Environment.
      name:
        type: string
        description: Name of the App Service Environment.
        readOnly: true
      type:
        type: string
        description: Resource type of the App Service Environment.
        readOnly: true
  CertificatePatchResource:
    type: object
    description: ARM resource for a certificate.
    properties:
      properties:
        $ref: '#/definitions/CertificatePatchResourceProperties'
        description: CertificatePatchResource resource specific properties
        x-ms-client-flatten: true
    allOf:
    - $ref: '#/definitions/ProxyOnlyResource'
  DefaultErrorResponseError:
    type: object
    description: Error model.
    properties:
      code:
        type: string
        description: Standardized string to programmatically identify the error.
        readOnly: true
      message:
        type: string
        description: Detailed error description and debugging information.
        readOnly: true
      target:
        type: string
        description: Detailed error description and debugging information.
        readOnly: true
      details:
        type: array
        items:
          $ref: '#/definitions/DefaultErrorResponseErrorDetailsItem'
        x-ms-identifiers: []
      innererror:
        type: string
        description: More information to debug error.
        readOnly: true
  DefaultErrorResponseErrorDetailsItem:
    type: object
    description: Detailed errors.
    properties:
      code:
        type: string
        description: Standardized string to programmatically identify the error.
        readOnly: true
      message:
        type: string
        description: Detailed error description and debugging information.
        readOnly: true
      target:
        type: string
        description: Detailed error description and debugging information.
        readOnly: true
  CertificateCollection:
    type: object
    description: Collection of certificates.
    properties:
      value:
        type: array
        description: The Certificate items on this page
        items:
          $ref: '#/definitions/Certificate'
      nextLink:
        type: string
        format: uri
        description: The link to the next page of items
    required:
    - value
  Certificate:
    type: object
    description: SSL certificate for an app.
    properties:
      properties:
        $ref: '#/definitions/CertificateProperties'
        description: Certificate resource specific properties
        x-ms-client-flatten: true
      kind:
        type: string
        description: Kind of resource. If the resource is an app, you can refer to https://github.com/Azure/app-service-linux-docs/blob/master/Things_You_Should_Know/kind_property.md#app-service-resource-kind-reference for details supported values for kind.
    allOf:
    - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/TrackedResource
  ProxyOnlyResource:
    type: object
    description: Azure proxy only resource. This resource is not tracked by Azure Resource Manager.
    properties:
      id:
        type: string
        description: Resource Id.
        readOnly: true
      name:
        type: string
        description: Resource Name.
        readOnly: true
      kind:
        type: string
        description: Kind of resource.
      type:
        type: string
        description: Resource type.
        readOnly: true
  CertificatePatchResourceProperties:
    type: object
    description: CertificatePatchResource resource specific properties
    properties:
      password:
        type: string
        description: Certificate password.
        readOnly: true
      friendlyName:
        type: string
        description: Friendly name of the certificate.
        readOnly: true
      subjectName:
        type: string
        description: Subject name of the certificate.
        readOnly: true
      hostNames:
        type: array
        description: Host names the certificate applies to.
        items:
          type: string
      pfxBlob:
        type: string
        format: byte
        description: Pfx blob.
      siteName:
        type: string
        description: App name.
        readOnly: true
      selfLink:
        type: string
        description: Self link.
        readOnly: true
      issuer:
        type: string
        description: Certificate issuer.
        readOnly: true
      issueDate:
        type: string
        format: date-time
        description: Certificate issue Date.
        readOnly: true
      expirationDate:
        type: string
        format: date-time
        description: Certificate expiration date.
        readOnly: true
      thumbprint:
        type: string
        description: Certificate thumbprint.
        readOnly: true
      valid:
        type: boolean
        description: Is the certificate valid?.
        readOnly: true
      cerBlob:
        type: string
        format: byte
        description: Raw bytes of .cer file
        readOnly: true
      publicKeyHash:
        type: string
        description: Public key hash.
        readOnly: true
      hostingEnvironmentProfile:
        $ref: '#/definitions/HostingEnvironmentProfile'
        description: Specification for the App Service Environment to use for the certificate.
        readOnly: true
      keyVaultId:
        type: string
        description: Key Vault Csm resource Id.
      keyVaultSecretName:
        type: string
        description: Key Vault secret name.
      keyVaultSecretStatus:
        $ref: '#/definitions/KeyVaultSecretStatus'
        description: Status of the Key Vault secret.
        readOnly: true
      serverFarmId:
        type: string
        description: 'Resource ID of the associated App Service plan, formatted as: "/subscriptions/{subscriptionID}/resourceGroups/{groupName}/providers/Microsoft.Web/serverfarms/{appServicePlanName}".'
      canonicalName:
        type: string
        description: CNAME of the certificate to be issued via free certificate
      domainValidationMethod:
        type: string
        description: Method of domain validation for free cert
  CertificateProperties:
    type: object
    description: Certificate resource specific properties
    properties:
      password:
        type: string
        description: Certificate password.
      friendlyName:
        type: string
        description: Friendly name of the certificate.
        readOnly: true
      subjectName:
        type: string
        description: Subject name of the certificate.
        readOnly: true
      hostNames:
        type: array
        description: Host names the certificate applies to.
        items:
          type: string
      pfxBlob:
        type: string
        format: byte
        description: Pfx blob.
      siteName:
        type: string
        description: App name.
        readOnly: true
      selfLink:
        type: string
        description: Self link.
        readOnly: true
      issuer:
        type: string
        description: Certificate issuer.
        readOnly: true
      issueDate:
        type: string
        format: date-time
        description: Certificate issue Date.
        readOnly: true
      expirationDate:
        type: string
        format: date-time
        description: Certificate expiration date.
        readOnly: true
      thumbprint:
        type: string
        description: Certificate thumbprint.
        readOnly: true
      valid:
        type: boolean
        description: Is the certificate valid?.
        readOnly: true
      cerBlob:
        type: string
        format: byte
        description: Raw bytes of .cer file
        readOnly: true
      publicKeyHash:
        type: string
        description: Public key hash.
        readOnly: true
      hostingEnvironmentProfile:
        $ref: '#/definitions/HostingEnvironmentProfile'
        description: Specification for the App Service Environment to use for the certificate.
        readOnly: true
      keyVaultId:
        type: string
        format: arm-id
        description: Azure Key Vault Csm resource Id.
        x-ms-arm-id-details:
          allowedResources:
          - type: Microsoft.KeyVault/vaults
      keyVaultSecretName:
        type: string
        description: Azure Key Vault secret name.
      keyVaultSecretStatus:
        $ref: '#/definitions/KeyVaultSecretStatus'
        description: Status of the Key Vault secret.
        readOnly: true
      serverFarmId:
        type: string
        format: arm-id
        description: Resource ID of the associated App Service plan.
        x-ms-arm-id-details:
          allowedResources:
          - type: Microsoft.Web/serverfarms
      canonicalName:
        type: string
        description: CNAME of the certificate to be issued via free certificate
      domainValidationMethod:
        type: string
        description: Method of domain validation for free cert
securityDefinitions:
  azure_auth:
    type: oauth2
    description: Azure Active Directory OAuth2 Flow.
    flow: implicit
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    scopes:
      user_impersonation: impersonate your user account