openapi: 3.0.1
info:
description: "The MongoDB Atlas Administration API allows developers to manage all components in MongoDB Atlas.\n\nThe Atlas Administration API supports OAuth2 Service Accounts and HTTP Digest-based API keys. Service accounts are the recommended authentication method and API keys are considered a legacy option.\n\nTo authenticate with a Service Account, first exchange its client ID and secret for an access token using the OAuth 2.0 Client Credentials flow. Atlas provides a token endpoint at `POST https://cloud.mongodb.com/api/oauth/token`, which returns a Bearer token that is reusable and valid for 1 hour (3600 seconds).\n\nFor example, to [return a list of your organizations](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listorgs) with [cURL](https://en.wikipedia.org/wiki/CURL), first generate an access token and then use that token to call the same Atlas Administration API endpoint shown in the current example:\n\n```\nACCESS_TOKEN=$(curl -fsS --request POST https://cloud.mongodb.com/api/oauth/token \\\n --header \"Authorization: Basic $(printf '%s' \"${CLIENT_ID}:${CLIENT_SECRET}\" | base64 | tr -d '\\n')\" \\\n --header \"Content-Type: application/x-www-form-urlencoded\" \\\n --header \"Accept: application/json\" \\\n --data \"grant_type=client_credentials\" | jq -r '.access_token')\n\ncurl --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/orgs?pretty=true\"\n```\n\nIf your organization requires an IP access list for the Atlas Administration API, the token can be created from any IP address, but the API call that uses the token must originate from an allowed IP.\n\nTo learn more, see [Get Started with the Atlas Administration API](https://www.mongodb.com/docs/atlas/configure-api-access/). For support, see [MongoDB Support](https://www.mongodb.com/support/get-started).\n\nYou can also explore the various endpoints available through the Atlas Administration API in MongoDB's [Postman workspace](https://www.postman.com/mongodb-devrel/workspace/mongodb-atlas-administration-apis/) (requires a Postman account)."
license:
name: CC BY-NC-SA 3.0 US
url: https://creativecommons.org/licenses/by-nc-sa/3.0/us/
termsOfService: https://www.mongodb.com/mongodb-management-service-terms-and-conditions
title: MongoDB Atlas Administration Access Tracking X.509 Authentication API
version: '2.0'
x-xgen-sha: 3d70e065843c008b9871ea7836c98c9de6f202f9
servers:
- url: https://cloud.mongodb.com
security:
- ServiceAccounts: []
- DigestAuth: []
tags:
- description: Returns, edits, and removes user-managed X.509 configurations. Also returns and generates MongoDB Cloud-managed X.509 certificates for database users. The following resources help manage database users who authenticate using X.509 certificates. You can manage these X.509 certificates or let MongoDB Cloud do it for you. If MongoDB Cloud manages your certificates, it also manages your Certificate Authority and can generate certificates for your database users. No additional X.509 configuration is required. If you manage your certificates, you must provide a Certificate Authority and generate certificates for your database users.
externalDocs:
description: Self-Managed X.509 Certificates
url: https://www.mongodb.com/docs/atlas/security-self-managed-x509/
name: X.509 Authentication
paths:
/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs:
get:
description: Returns all unexpired X.509 certificates for the specified MongoDB user. This MongoDB user belongs to one project. Atlas manages these certificates and the MongoDB user. To use this resource, the requesting Service Account or API Key must have the Project Read Only role.
operationId: listGroupDatabaseUserCerts
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/includeCount'
- $ref: '#/components/parameters/itemsPerPage'
- $ref: '#/components/parameters/pageNum'
- $ref: '#/components/parameters/pretty'
- description: Human-readable label that represents the MongoDB database user account whose certificates you want to return.
in: path
name: username
required: true
schema:
type: string
responses:
'200':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/PaginatedUserCertView'
x-xgen-version: '2023-01-01'
description: OK
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Return All X.509 Certificates Assigned to One Database User
tags:
- X.509 Authentication
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api x509Authentication listDatabaseUserCerts --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.ListGroupDatabaseUserCertsApiParams{}\n\tsdkResp, httpResp, err := client.X509AuthenticationApi.\n\t\tListGroupDatabaseUserCertsWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs?pretty=true\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X GET \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs?pretty=true\""
x-rolesRequirements:
- Project Read Only
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/X.509-Authentication/operation/listGroupDatabaseUserCerts
x-xgen-operation-id-override: listDatabaseUserCerts
post:
description: 'Generates one X.509 certificate for the specified MongoDB user. Atlas manages the certificate and MongoDB user that belong to one project. To use this resource, the requesting Service Account or API Key must have the Project Owner role.
To get MongoDB Cloud to generate a managed certificate for a database user, set `"x509Type" : "MANAGED"` on the desired MongoDB Database User.
If you are managing your own Certificate Authority (CA) in Self-Managed X.509 mode, you must generate certificates for database users using your own CA.'
externalDocs:
description: Self-Managed X.509
url: https://www.mongodb.com/docs/atlas/security-self-managed-x509/#std-label-self-managed-x509
operationId: createGroupDatabaseUserCert
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
- $ref: '#/components/parameters/pretty'
- description: Human-readable label that represents the MongoDB database user account for whom to create a certificate.
in: path
name: username
required: true
schema:
type: string
requestBody:
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/UserCert'
description: Generates one X.509 certificate for the specified MongoDB user.
required: true
responses:
'201':
content:
application/vnd.atlas.2023-01-01+json:
schema:
description: PEM file that contains the user's X.509 certificate and private key.
type: string
x-xgen-version: '2023-01-01'
description: This endpoint returns a PEM file with the certificate and private key.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'400':
$ref: '#/components/responses/badRequest'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'409':
$ref: '#/components/responses/conflict'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Create One X.509 Certificate for One Database User
tags:
- X.509 Authentication
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api x509Authentication createDatabaseUserCert --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.CreateGroupDatabaseUserCertApiParams{}\n\tsdkResp, httpResp, err := client.X509AuthenticationApi.\n\t\tCreateGroupDatabaseUserCertWithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs\" \\\n -d '{ <Payload> }'"
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n --header \"Content-Type: application/json\" \\\n -X POST \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/databaseUsers/{username}/certs\" \\\n -d '{ <Payload> }'"
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/X.509-Authentication/operation/createGroupDatabaseUserCert
x-xgen-operation-id-override: createDatabaseUserCert
/api/atlas/v2/groups/{groupId}/userSecurity/customerX509:
delete:
description: "Clears the customer-managed X.509 settings on a project, including the uploaded Certificate Authority, which disables self-managed X.509.\n\n Updating this configuration triggers a rolling restart of the database. You must have the Project Owner role to use this endpoint."
operationId: disableGroupUserSecurityCustomerX509
parameters:
- $ref: '#/components/parameters/envelope'
- $ref: '#/components/parameters/groupId'
responses:
'202':
content:
application/vnd.atlas.2023-01-01+json:
schema:
$ref: '#/components/schemas/UserSecurity'
x-xgen-version: '2023-01-01'
description: Accepted
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
'401':
$ref: '#/components/responses/unauthorized'
'403':
$ref: '#/components/responses/forbidden'
'404':
$ref: '#/components/responses/notFound'
'429':
$ref: '#/components/responses/tooManyRequests'
'500':
$ref: '#/components/responses/internalServerError'
summary: Disable Customer-Managed X.509
tags:
- X.509 Authentication
x-codeSamples:
- lang: cURL
label: Atlas CLI
source: atlas api x509Authentication disableSecurityCustomerX509 --help
- lang: go
label: Go
source: "import (\n\t\"os\"\n\t\"context\"\n\t\"log\"\n\tsdk \"go.mongodb.org/atlas-sdk/v20250312001/admin\"\n)\n\nfunc main() {\n\tctx := context.Background()\n\tclientID := os.Getenv(\"MONGODB_ATLAS_CLIENT_ID\")\n\tclientSecret := os.Getenv(\"MONGODB_ATLAS_CLIENT_SECRET\")\n\n\t// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth\n\tclient, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))\n\n\tif err != nil {\n\t\tlog.Fatalf(\"Error: %v\", err)\n\t}\n\n\tparams = &sdk.DisableGroupUserSecurityCustomerX509ApiParams{}\n\thttpResp, err := client.X509AuthenticationApi.\n\t\tDisableGroupUserSecurityCustomerX509WithParams(ctx, params).\n\t\tExecute()\n}\n"
- lang: cURL
label: curl (Service Accounts)
source: "curl --include --header \"Authorization: Bearer ${ACCESS_TOKEN}\" \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/customerX509\""
- lang: cURL
label: curl (Digest)
source: "curl --user \"${PUBLIC_KEY}:${PRIVATE_KEY}\" \\\n --digest --include \\\n --header \"Accept: application/vnd.atlas.2025-03-12+json\" \\\n -X DELETE \"https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/userSecurity/customerX509\""
x-rolesRequirements:
- Project Owner
x-xgen-docs-url: https://mongodb.com/docs/atlas/reference/api-resources-spec/v2/#tag/X.509-Authentication/operation/disableGroupUserSecurityCustomerX509
x-xgen-method-verb-override:
customMethod: 'True'
verb: disable
x-xgen-operation-id-override: disableSecurityCustomerX509
components:
responses:
internalServerError:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 500
errorCode: UNEXPECTED_ERROR
reason: Internal Server Error
schema:
$ref: '#/components/schemas/ApiError'
description: Internal Server Error.
forbidden:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 403
errorCode: CANNOT_CHANGE_GROUP_NAME
reason: Forbidden
schema:
$ref: '#/components/schemas/ApiError'
description: Forbidden.
tooManyRequests:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 429
errorCode: RATE_LIMITED
reason: Too Many Requests
schema:
$ref: '#/components/schemas/ApiError'
description: Too Many Requests.
headers:
RateLimit-Limit:
$ref: '#/components/headers/HeaderRateLimitLimit'
RateLimit-Remaining:
$ref: '#/components/headers/HeaderRateLimitRemaining'
Retry-After:
$ref: '#/components/headers/HeaderRetryAfter'
unauthorized:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint)
error: 401
errorCode: NOT_ORG_GROUP_CREATOR
reason: Unauthorized
schema:
$ref: '#/components/schemas/ApiError'
description: Unauthorized.
conflict:
content:
application/json:
example:
detail: '(This is just an example, the exception may not be related to this endpoint) Cannot delete organization link while there is active migration in following project ids: 60c4fd418ebe251047c50554'
error: 409
errorCode: CANNOT_DELETE_ORG_ACTIVE_LIVE_MIGRATION_ATLAS_ORG_LINK
reason: Conflict
schema:
$ref: '#/components/schemas/ApiError'
description: Conflict.
badRequest:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint) No provider AWS exists.
error: 400
errorCode: VALIDATION_ERROR
reason: Bad Request
schema:
$ref: '#/components/schemas/ApiError'
description: Bad Request.
notFound:
content:
application/json:
example:
detail: (This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS
error: 404
errorCode: RESOURCE_NOT_FOUND
reason: Not Found
schema:
$ref: '#/components/schemas/ApiError'
description: Not Found.
schemas:
LDAPSecuritySettings:
description: Lightweight Directory Access Protocol (LDAP) over Transport Layer Security (TLS) configuration details that apply to the specified project.
properties:
authenticationEnabled:
description: Flag that indicates whether users can authenticate using an Lightweight Directory Access Protocol (LDAP) host.
type: boolean
authorizationEnabled:
description: Flag that indicates whether users can authorize access to MongoDB Cloud resources using an Lightweight Directory Access Protocol (LDAP) host.
type: boolean
authzQueryTemplate:
default: '{USER}?memberOf?base'
description: Lightweight Directory Access Protocol (LDAP) query template that MongoDB Cloud runs to obtain the LDAP groups associated with the authenticated user. MongoDB Cloud uses this parameter only for user authorization. Use the `{USER}` placeholder in the Uniform Resource Locator (URL) to substitute the authenticated username. The query relates to the host specified with the hostname. Format this query according to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
example: '{USER}?memberOf?base'
type: string
bindPassword:
description: Password that MongoDB Cloud uses to authenticate the `bindUsername`.
type: string
writeOnly: true
bindUsername:
description: Full Distinguished Name (DN) of the Lightweight Directory Access Protocol (LDAP) user that MongoDB Cloud uses to connect to the LDAP host. LDAP distinguished names must be formatted according to RFC 2253.
example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
externalDocs:
description: RFC 2253
url: https://tools.ietf.org/html/2253
pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
type: string
caCertificate:
description: 'Certificate Authority (CA) certificate that MongoDB Cloud uses to verify the identity of the Lightweight Directory Access Protocol (LDAP) host. MongoDB Cloud allows self-signed certificates. To delete an assigned value, pass an empty string: `"caCertificate": ""`.'
type: string
hostname:
description: Human-readable label that identifies the hostname or Internet Protocol (IP) address of the Lightweight Directory Access Protocol (LDAP) host. This host must have access to the internet or have a Virtual Private Cloud (VPC) peering connection to your cluster.
pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{1,4}:){7}([0-9a-f]{1,4})|(([a-z0-9]+\.){1,10}[a-z]+)?$
type: string
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
port:
default: 636
description: Port to which the Lightweight Directory Access Protocol (LDAP) host listens for client connections.
format: int32
type: integer
userToDNMapping:
description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
items:
$ref: '#/components/schemas/UserToDNMapping'
type: array
title: LDAP Security Settings
type: object
Link:
properties:
href:
description: Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
example: https://cloud.mongodb.com/api/atlas
type: string
rel:
description: Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with `https://cloud.mongodb.com/api/atlas`.
example: self
type: string
type: object
UserToDNMapping:
description: User-to-Distinguished Name (DN) map that MongoDB Cloud uses to transform a Lightweight Directory Access Protocol (LDAP) username into an LDAP DN.
properties:
ldapQuery:
description: Lightweight Directory Access Protocol (LDAP) query template that inserts the LDAP name that the regular expression matches into an LDAP query Uniform Resource Identifier (URI). The formatting for the query must conform to [RFC 4515](https://datatracker.ietf.org/doc/html/rfc4515) and [RFC 4516](https://datatracker.ietf.org/doc/html/rfc4516).
type: string
match:
description: Regular expression that MongoDB Cloud uses to match against the provided Lightweight Directory Access Protocol (LDAP) username. Each parenthesis-enclosed section represents a regular expression capture group that the substitution or `ldapQuery` template uses.
example: (.*)
type: string
substitution:
description: Lightweight Directory Access Protocol (LDAP) Distinguished Name (DN) template that converts the LDAP username that matches regular expression in the *match* parameter into an LDAP Distinguished Name (DN).
example: CN={0},CN=Users,DC=my-atlas-ldap-server,DC=example,DC=com
type: string
required:
- match
title: User to Distinguished Name Mapping
type: object
DBUserTLSX509Settings:
description: Settings to configure TLS Certificates for database users.
properties:
cas:
description: Concatenated list of customer certificate authority (CA) certificates needed to authenticate database users. MongoDB Cloud expects this as a PEM-formatted certificate.
type: string
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
title: Database User TLS Certificate Settings
type: object
ApiError:
properties:
badRequestDetail:
$ref: '#/components/schemas/BadRequestDetail'
detail:
description: Describes the specific conditions or reasons that cause each type of error.
type: string
error:
description: HTTP status code returned with this error.
externalDocs:
url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
format: int32
readOnly: true
type: integer
errorCode:
description: Application error code returned with this error.
readOnly: true
type: string
parameters:
description: Parameters used to give more information about the error.
items:
type: object
readOnly: true
type: array
reason:
description: Application error message returned with this error.
readOnly: true
type: string
required:
- error
- errorCode
type: object
PaginatedUserCertView:
properties:
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
results:
description: List of returned documents that MongoDB Cloud provides when completing this request.
items:
$ref: '#/components/schemas/UserCert'
readOnly: true
type: array
totalCount:
description: Total number of documents available. MongoDB Cloud omits this value if `includeCount` is set to `false`. The total number is an estimate and may not be exact.
format: int32
minimum: 0
readOnly: true
type: integer
required:
- results
type: object
BadRequestDetail:
description: Bad request detail.
properties:
fields:
description: Describes all violations in a client request.
items:
$ref: '#/components/schemas/FieldViolation'
type: array
readOnly: true
type: object
FieldViolation:
properties:
description:
description: A description of why the request element is bad.
type: string
field:
description: A path that leads to a field in the request body.
type: string
required:
- description
- field
type: object
UserSecurity:
properties:
customerX509:
$ref: '#/components/schemas/DBUserTLSX509Settings'
ldap:
$ref: '#/components/schemas/LDAPSecuritySettings'
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
type: object
UserCert:
properties:
_id:
description: Unique 24-hexadecimal character string that identifies this certificate.
format: int64
readOnly: true
type: integer
createdAt:
description: Date and time when MongoDB Cloud created this certificate. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
format: date-time
readOnly: true
type: string
groupId:
description: Unique 24-hexadecimal character string that identifies the project.
example: 32b6e34b3d91647abb20e7b8
pattern: ^([a-f0-9]{24})$
readOnly: true
type: string
links:
description: List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
externalDocs:
description: Web Linking Specification (RFC 5988)
url: https://datatracker.ietf.org/doc/html/rfc5988
items:
$ref: '#/components/schemas/Link'
readOnly: true
type: array
monthsUntilExpiration:
default: 3
description: Number of months that the certificate remains valid until it expires.
format: int32
maximum: 24
type: integer
writeOnly: true
notAfter:
description: Date and time when this certificate expires. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
format: date-time
readOnly: true
type: string
subject:
description: Subject Alternative Name associated with this certificate. This parameter expresses its value as a distinguished name as defined in RFC 2253.
example: CN=BindUser,CN=Users,DC=myldapserver,DC=mycompany,DC=com
externalDocs:
description: RFC 2253
url: https://tools.ietf.org/html/2253
pattern: ^(?:(?<cn>CN=(?<name>[^,]*)),)?(?:(?<path>(?:(?:CN|OU)=[^,]+,?)+),)?(?<domain>(?:DC=[^,]+,?)+)$
readOnly: true
type: string
type: object
parameters:
envelope:
description: Flag that indicates whether Application wraps the response in an `envelope` JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.
in: query
name: envelope
schema:
default: false
type: boolean
groupId:
description: 'Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access.
**NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.'
in: path
name: groupId
required: true
schema:
example: 32b6e34b3d91647abb20e7b8
pattern: ^([a-f0-9]{24})$
type: string
itemsPerPage:
description: Number of items that the response returns per page.
in: query
name: itemsPerPage
schema:
default: 100
maximum: 500
minimum: 1
type: integer
pretty:
description: Flag that indicates whether the response body should be in the prettyprint format.
in: query
name: pretty
schema:
default: false
externalDocs:
description: Prettyprint
url: https://en.wikipedia.org/wiki/Prettyprint
type: boolean
pageNum:
description: Number of the page that displays the current set of the total objects that the response returns.
in: query
name: pageNum
schema:
default: 1
minimum: 1
type: integer
includeCount:
description: Flag that indicates whether the response returns the total number of items (`totalCount`) in the response.
in: query
name: includeCount
schema:
default: true
type: boolean
headers:
HeaderRetryAfter:
description: The minimum time you should wait, in seconds, before retrying the API request. This header might be returned for 429 or 503 erro
# --- truncated at 32 KB (33 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mongodb/refs/heads/main/openapi/mongodb-x-509-authentication-api-openapi.yml