SmallStep PKI Architecture API

openapi: 3.1.1
info:
  contact:
    email: support@smallstep.com
    name: Smallstep Support
    url: https://support.smallstep.com
  description: '# Getting Started

    First you''ll need to get an API token from the Team Settings page of your [Smallstep dashboard](https://smallstep.com/app).


    Then you can try [listing certificates](/operations/list-certificates) for your first API call:

    ```

    set +o history

    echo "Authorization: Bearer [your API token]" > api_headers

    set -o history

    curl -H @api_headers https://gateway.smallstep.com/api/certificates

    ```


    More resources:

    * [Terraform Provider](https://github.com/smallstep/terraform-provider-smallstep)

    * [Python Client](https://github.com/smallstep/smallstep-python)

    '
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  summary: Smallstep API
  title: Smallstep Authentication PKI Architecture API
  version: '2025-01-01'
servers:
- url: https://gateway.smallstep.com/api
security:
- JWT: []
tags:
- description: Manage certificate authorities and provisioners
  name: PKI Architecture
paths:
  /authorities:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    get:
      description: List all of a team's authorities.
      operationId: GetAuthorities
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/authority'
                type: array
          description: 'The full list of authorities.

            '
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-authorities
      summary: List Authorities
      tags:
      - PKI Architecture
    post:
      description: 'Create a new devops or advanced authority hosted by Smallstep.

        '
      operationId: PostAuthorities
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newAuthority'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authority'
          description: 'The authority that was created.

            '
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
        '412':
          $ref: '#/components/responses/412'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authorities
      summary: Create New Authority
      tags:
      - PKI Architecture
  /authorities/csr:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    post:
      description: 'Create a new advanced authority hosted by Smallstep with an external root.

        Returns a CSR for the authority''s intermediate issuer that must be signed and submitted to the `/authorities/:id/root` endpoint before the authority will be able to issue certificates.

        '
      operationId: PostAuthoritiesCsr
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newAuthorityCsr'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authorityCsr'
          description: 'The CSR for the authority''s intermediate issuer.

            '
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
        '412':
          $ref: '#/components/responses/412'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authorities-csr
      summary: Create New Authority CSR
      tags:
      - PKI Architecture
  /authorities/{authorityDomainOrID}:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityDomainOrID'
    delete:
      description: Delete an Authority by ID.
      operationId: DeleteAuthority
      responses:
        '204':
          $ref: '#/components/responses/204'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - delete-authority
      summary: Delete Authority
      tags:
      - PKI Architecture
    get:
      description: Get a single authority by ID or domain.
      operationId: GetAuthority
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authority'
          description: A single authority.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-authority
      summary: Get Authority
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    get:
      description: List all provisioners attached to an authority.
      operationId: ListAuthorityProvisioners
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/provisioner'
                type: array
          description: The full list of provisioners attached to the authority.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - list-authority-provisioners
      summary: List Authority Provisioners
      tags:
      - PKI Architecture
    post:
      description: Create a new provisioner attached to an authority.
      operationId: PostAuthorityProvisioners
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/provisioner'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisioner'
          description: The new provisioner.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authority-provisioners
      summary: Create Authority Provisioner
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners/{provisionerNameOrID}:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    - $ref: '#/components/parameters/provisionerNameOrID'
    delete:
      description: Delete a single provisioner by name or ID.
      operationId: DeleteProvisioner
      responses:
        '204':
          $ref: '#/components/responses/204'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - delete-provisioner
      summary: Delete Provisioner
      tags:
      - PKI Architecture
    get:
      description: Get a single provisioner by name or ID.
      operationId: GetProvisioner
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisioner'
          description: The requested provisioner.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-provisioner
      summary: Get Provisioner
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    - $ref: '#/components/parameters/provisionerNameOrID'
    post:
      description: Add a webhook to a provisioner.
      operationId: PostWebhooks
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/provisionerWebhook'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisionerWebhook'
          description: The new webhook.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
        '412':
          $ref: '#/components/responses/412'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-webhooks
      summary: Create Provisioner Webhook
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks/{webhookNameOrID}:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    - $ref: '#/components/parameters/provisionerNameOrID'
    - $ref: '#/components/parameters/webhookNameOrID'
    delete:
      description: Delete a single provisioner webhook by name or ID.
      operationId: DeleteWebhook
      responses:
        '204':
          $ref: '#/components/responses/204'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - delete-webhook
      summary: Delete Provisioner Webhook
      tags:
      - PKI Architecture
    get:
      description: Get a single provisioner webhook by name or ID.
      operationId: GetWebhook
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisionerWebhook'
          description: The requested webhook.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-webhook
      summary: Get Provisioner Webhook
      tags:
      - PKI Architecture
  /authorities/{authorityID}/root:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    post:
      description: 'Finalize creation of a new advanced Authority with external root by submitting the signed certificate for the CSR previously returned from the `/authorities/csr` endpoint.

        Also submit the root certificate and a name for the root.

        The authority will be ready to issue certificates after this operation completes.

        '
      operationId: PostAuthorityRoot
      requestBody:
        content:
          application/json:
            schema:
              properties:
                adminEmails:
                  description: Users that will have admin access to manage the authority
                  items:
                    pattern: ^[\w-.]+@[\w-.]+$
                    type: string
                  minItems: 1
                  type: array
                  uniqueItems: true
                id:
                  description: The `id` returned from a previous call to `/authorities/csr`
                  type: string
                intermediatePEM:
                  description: The signed intermediate certificate
                  type: string
                rootName:
                  description: A name for the external root issuer
                  type: string
                rootPEM:
                  description: The root certificate in PEM format
                  type: string
              required:
              - id
              - rootName
              - rootPEM
              - intermediatePEM
              - adminEmails
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authority'
          description: The Authority that was updated
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authority-root
      summary: Post Authority External Root
      tags:
      - PKI Architecture
components:
  schemas:
    gcpDisableCustomSANs:
      description: By default custom SANs are valid, but if this option is set to `true` only the SANs available in the instance identity document will be valid, these are the DNS `<instance-name>.c.<project-id>.internal` and `<instance-name>.<zone>.c.<project-id>.internal`.
      title: GCP Disable Custom SANs
      type: boolean
    acmeAttestationProvisioner:
      description: A [provisioner](https://smallstep.com/docs/step-ca/provisioners/#acme) that enables automation with the [device-attest-01 challenge of the ACME protocol](https://smallstep.com/blog/acme-managed-device-attestation-explained/).
      properties:
        attestationFormats:
          description: The allowed attestation formats for the device-attest-01 challenge. Valid values are `apple`, `step`, and `tpm`. The apple format is for Apple devices, and adds trust for Apple's CAs. The step format is for non-TPM devices that can issue attestation certificates, such as YubiKey PIV. It adds trust for Yubico's root CA. The tpm format is for TPMs and does not trust any CAs by default.
          items:
            enum:
            - apple
            - step
            - tpm
            type: string
          minItems: 1
          type: array
          uniqueItems: true
        attestationRoots:
          description: A trust bundle of root certificates in PEM format that will be used to verify attestation certificates. The default value depends on the value of attestationFormats. If provided, this PEM bundle will override the CA trust established by setting attestationFormats to apple or step. At least one root certificate is required when using the tpm attestationFormat.
          items:
            type: string
          type: array
        forceCN:
          description: Force one of the SANs to become the Common Name, if a Common Name is not provided.
          type: boolean
        requireEAB:
          description: Only ACME clients that have been preconfigured with valid EAB credentials will be able to create an account with this provisioner.
          type: boolean
      required:
      - attestationFormats
      title: ACME Device Attestation Provisioner
      type: object
    basicAuth:
      description: Configures provisioner webhook requests to include an Authorization header with these credentials. Optional for `EXTERNAL` webhook servers; not allowed with hosted webhook servers. At most one of `bearerToken` and `basicAuth` may be set.
      example:
        password: secret
        username: user
      properties:
        password:
          type: string
        username:
          type: string
      required:
      - username
      - password
      title: Basic Auth
      type: object
    jwkProvisioner:
      description: A [provisioner](https://smallstep.com/docs/step-ca/provisioners/#jwk) that uses public-key cryptography to sign and validate a JSON Web Token (JWT).
      properties:
        encryptedKey:
          description: The JWE encrypted private key.
          type: string
        key:
          description: The public JSON web key.
          schema: {}
      required:
      - key
      title: JWK Provisioner
      type: object
    gcpServiceAccounts:
      description: The list of service accounts that are allowed to use a GCP cloud provisioner.
      items:
        type: string
      title: GCP Service Accounts
      type: array
    error:
      example:
        message: ID must be a valid UUID
      properties:
        message:
          description: A description of the error.
          type: string
      required:
      - message
      title: Error
      type: object
    scepProvisioner:
      description: The [SCEP provisioner](https://smallstep.com/docs/step-ca/provisioners/#scep) grants certificates to clients using the SCEP protocol. This type is currently experimental and subject to change.
      properties:
        autogenerateDecrypter:
          description: Automatically generate a new RSA decrypter instead of providing one.
          type: boolean
        challenge:
          description: A static challenge secret.
          type: string
        decrypterCertificate:
          description: A PEM-encoded certificate for an RSA public key.
          type: string
        decrypterKey:
          description: The PEM-encoded RSA private key, corresponding to the certificate public key.
          type: string
        decrypterKeyPassword:
          description: The password for the PEM-encoded RSA private key, if any.
          type: string
        encryptionAlgorithmIdentifier:
          default: AES_256_CBC
          description: "The encryption algorithm used for encrypting responses to the SCEP client:\n * `DES_CBC`    - [DES in CBC mode](https://www.rfc-editor.org/rfc/rfc8018.html#appendix-B.2.1) - `1.3.14.3.2.7`\n * `AES_128_CBC` - [AES-128 in CBC mode](https://www.rfc-editor.org/rfc/rfc8018.html#appendix-B.2.5) - `2.16.840.1.101.3.4.1.2`\n * `AES_128_GCM` - [AES-128 in GCM mode](https://www.rfc-editor.org/rfc/rfc5084.html#section-3.2) - `2.16.840.1.101.3.4.1.6`\n * `AES_256_CBC` - [AES-256 in CBC mode](https://www.rfc-editor.org/rfc/rfc3565.html#section-4.1) - `2.16.840.1.101.3.4.1.42`\n * `AES_256_GCM` - [AES-256 in GCM mode](https://www.rfc-editor.org/rfc/rfc5084.html#section-3.2) - `2.16.840.1.101.3.4.1.46`\n"
          enum:
          - DES_CBC
          - AES_128_CBC
          - AES_128_GCM
          - AES_256_CBC
          - AES_256_GCM
          type: string
        excludeIntermediate:
          default: false
          description: Exclude the intermediate CA certificate in SCEP responses.
          type: boolean
        forceCN:
          description: Force one of the SANs to become the Common Name, if a Common Name is not provided.
          type: boolean
        includeRoot:
          default: false
          description: Include the root CA certificate in SCEP responses.
          type: boolean
        minimumPublicKeyLength:
          default: 2048
          description: The minimum number of bits for RSA public keys accepted in SCEP requests.
          maximum: 8192
          minimum: 1
          multipleOf: 8
          type: integer
      title: SCEP Provisioner
      type: object
      x-experimental: true
    oidcProvisioner:
      description: A [provisioner](https://smallstep.com/docs/step-ca/provisioners/#oauthoidc-single-sign-on) that is configured to trust and accept an OAuth provider's ID tokens for authentication. By default, the issued certificate will use the subject (sub) claim from the identity token as its subject. The value of the token's email claim is also included as an email SAN in the certificate.
      properties:
        admins:
          description: The emails of admin users in an OpenID Connect provisioner. These users will not have restrictions in the certificates to sign.
          items:
            type: string
          type: array
        clientID:
          description: The id used to validate the audience in an OpenID Connect token.
          type: string
        clientSecret:
          description: The secret used to obtain the OpenID Connect tokens.
          type: string
        configurationEndpoint:
          description: OpenID Connect configuration URL.
          type: string
        domains:
          description: The domains used to validate the email claim in an OpenID Connect provisioner.
          items:
            type: string
          type: array
        groups:
          description: The group list used to validate the groups extension in an OpenID Connect token.
          items:
            type: string
          type: array
        listenAddress:
          description: The callback address used in the OpenID Connect flow.
          type: string
        tenantID:
          description: The tenant-id used to replace the templatized tenantid value in the OpenID Configuration.
          type: string
      required:
      - clientID
      - clientSecret
      - configurationEndpoint
      title: OIDC Provisioner
      type: object
    authority:
      description: 'An X.509 authority hosted by Smallstep.

        '
      examples:
      - activeRevocation: true
        createdAt: '2020-03-12T02:30:53.708Z'
        id: fe4d17b4-7b47-447b-97a4-4510a532b559
        name: My Advanced Authority
        root: "-----BEGIN CERTIFICATE-----\n ... \n-----END CERTIFICATE-----\n"
        subdomain: my-advanced
        type: advanced
      properties:
        activeRevocation:
          description: Whether CRL and OCSP are enabled (advanced authorities only).
          type: boolean
        adminEmails:
          description: Users that have admin access to manage the authority.
          items:
            type: string
          type: array
        createdAt:
          description: Timestamp when the authority was created.
          format: date-time
          type: string
        domain:
          description: The domain where the authority can be reached.
          type: string
        fingerprint:
          description: The SHA-256 digest of the authority's root certificate in hex format.
          type: string
        id:
          description: A UUID identifying this authority.
          type: string
        name:
          description: The name of the authority.
          type: string
        root:
          description: The root certificate in PEM format.
          type: string
        type:
          $ref: '#/components/schemas/authorityType'
      required:
      - id
      - name
      - domain
      - type
      - createdAt
      title: Authority
      type: object
    newAuthority:
      description: 'The body of a request to create a new authority.

        '
      examples:
      - activeRevocation: false
        adminEmails:
        - user@example.com
        name: Devops Authority
        subdomain: my-devops
        type: devops
      - activeRevocation: true
        adminEmails:
        - user@example.com
        name: Advanced Authority
        subdomain: my-advanced
        type: advanced
      properties:
        activeRevocation:
          description: Whether to enable CRL and OCSP on an advanced authority.
          type: boolean
        adminEmails:
          description: Users that will have admin access to manage the authority.
          items:
            pattern: ^[\w-.]+@[\w-.]+$
            type: string
          minItems: 1
          type: array
          uniqueItems: true
        intermediateIssuer:
          $ref: '#/components/schemas/x509Issuer'
        name:
          description: The name of the authority.
          type: string
        rootIssuer:
          $ref: '#/components/schemas/x509Issuer'
        subdomain:
          description: The new authority will be available at <subdomain>.<team slug>.ca.smallstep.com.
          type: string
        type:
          description: Create either a devops or advanced authority.
          enum:
          - devops
          - advanced
          type: string
      required:
      - name
      - subdomain
      - type
      - adminEmails
      title: New Hosted Authority
      type: object
    provisionerClaims:
      description: A set of constraints configuring how this provisioner can be used to issue certificates.
      example:
        allowRenewalAfterExpiry: true
        defaultHostSSHCertDuration: 168h
        defaultTLSCertDuration: 24h
        defaultUserSSHCertDuration: 12h
        disableRenewal: false
        enableSSHCA: true
        maxHostSSHCertDuration: 168h
        maxTLSCertDuration: 168h
        maxUserSSHCertDuration: 24h
        minHostSSHCertDuration: 48h
        minTLSCertDuration: 1h
        minUserSSHCertDuration: 4h
      properties:
        allowRenewalAfterExpiry:
          description: Allow renewals for expired certificates generated by this provisioner.
          type: boolean
        defaultHostSSHCertDuration:
          description: The default duration for an SSH host certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        defaultTLSCertDuration:
          description: The default duration for an X.509 certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        defaultUserSSHCertDuration:
          description: The default duration for an SSH user certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        disableRenewal:
          description: Disable renewal for all certificates generated by this provisioner.
          type: boolean
        enableSSHCA:
          description: Allow this provisioner to be used to generate SSH certificates.
          type: boolean
        maxHostSSHCertDuration:
          description: The maximum duration for an SSH host certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        maxTLSCertDuration:
          description: The maximum duration for an X.509 certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        maxUserSSHCertDuration:
          description: The maximum duration for an SSH user certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        minHostSSHCertDuration:
          description: The minimum duration for an SSH host certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        minTLSCertDuration:
          description: The minimum duration for an X.509 certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
        minUserSSHCertDuration:
          description: The minimum duration for an SSH user certificate generated by this provisioner. Parsed as a [Golang duration](https://pkg.go.dev/time#ParseDuration).
          type: string
      title: Provisioner Claims
      type: object
    provisionerOptions:
      description: Options that apply when issuing certificates with this provisioner.
      properties:
        ssh:
          $ref: '#/components/schemas/sshOptions'
        webhooks:
          items:
            $ref: '#/components/schemas/provisionerWebhook'
          type: array
        x509:
          $ref: '#/components/schemas/x509Options'
      title: Provisioner Options
      type: object
    awsAccounts:
      description: The list of AWS account IDs that are allowed to use an AWS cloud provisioner.
      items:
        type: string
      title: AWS Accounts
      type: array
    provisionerWebhook:
      description: A [webhook](https://smallstep.com/docs/step-ca/webhooks/) to call when a certificate request is being processed.
      examples:
      - certType: X509
        id: 4ad05dca-ab33-409a-88ec-8ea4a5ad3d79
        kind: ENRICHING
        name: devices
        serverType: HOSTED_ATTESTA

# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/smallstep/refs/heads/main/openapi/smallstep-pki-architecture-api-openapi.yml