SmallStep PKI Architecture API

openapi: 3.2.0
info:
  contact:
    email: support@smallstep.com
    name: Smallstep Support
    url: https://support.smallstep.com
  description: '# Getting Started

    First you''ll need to get an API token from the Team Settings page of your [Smallstep dashboard](https://smallstep.com/app).


    Then you can try [listing certificates](/operations/list-certificates) for your first API call:

    ```

    set +o history

    echo "Authorization: Bearer [your API token]" > api_headers

    set -o history

    curl -H @api_headers https://gateway.smallstep.com/api/certificates

    ```


    More resources:

    * [Terraform Provider](https://github.com/smallstep/terraform-provider-smallstep)

    * [Python Client](https://github.com/smallstep/smallstep-python)

    '
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  summary: Smallstep API
  title: Smallstep Authentication PKI Architecture API
  version: '2025-01-01'
servers:
- url: https://gateway.smallstep.com/api
security:
- JWT: []
tags:
- description: Manage certificate authorities and provisioners
  name: PKI Architecture
paths:
  /authorities:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    get:
      description: List all of a team's authorities.
      operationId: GetAuthorities
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/authority'
                type: array
          description: 'The full list of authorities.

            '
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-authorities
      summary: List Authorities
      tags:
      - PKI Architecture
    post:
      description: 'Create a new devops or advanced authority hosted by Smallstep.

        '
      operationId: PostAuthorities
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newAuthority'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authority'
          description: 'The authority that was created.

            '
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
        '412':
          $ref: '#/components/responses/412'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authorities
      summary: Create New Authority
      tags:
      - PKI Architecture
  /authorities/csr:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    post:
      description: 'Create a new advanced authority hosted by Smallstep with an external root.

        Returns a CSR for the authority''s intermediate issuer that must be signed and submitted to the `/authorities/:id/root` endpoint before the authority will be able to issue certificates.

        '
      operationId: PostAuthoritiesCsr
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newAuthorityCsr'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authorityCsr'
          description: 'The CSR for the authority''s intermediate issuer.

            '
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '409':
          $ref: '#/components/responses/409'
        '412':
          $ref: '#/components/responses/412'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authorities-csr
      summary: Create New Authority CSR
      tags:
      - PKI Architecture
  /authorities/{authorityDomainOrID}:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityDomainOrID'
    delete:
      description: Delete an Authority by ID.
      operationId: DeleteAuthority
      responses:
        '204':
          $ref: '#/components/responses/204'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - delete-authority
      summary: Delete Authority
      tags:
      - PKI Architecture
    get:
      description: Get a single authority by ID or domain.
      operationId: GetAuthority
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authority'
          description: A single authority.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-authority
      summary: Get Authority
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    get:
      description: List all provisioners attached to an authority.
      operationId: ListAuthorityProvisioners
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/provisioner'
                type: array
          description: The full list of provisioners attached to the authority.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - list-authority-provisioners
      summary: List Authority Provisioners
      tags:
      - PKI Architecture
    post:
      description: Create a new provisioner attached to an authority.
      operationId: PostAuthorityProvisioners
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/provisioner'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisioner'
          description: The new provisioner.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authority-provisioners
      summary: Create Authority Provisioner
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners/{provisionerNameOrID}:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    - $ref: '#/components/parameters/provisionerNameOrID'
    delete:
      description: Delete a single provisioner by name or ID.
      operationId: DeleteProvisioner
      responses:
        '204':
          $ref: '#/components/responses/204'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - delete-provisioner
      summary: Delete Provisioner
      tags:
      - PKI Architecture
    get:
      description: Get a single provisioner by name or ID.
      operationId: GetProvisioner
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisioner'
          description: The requested provisioner.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-provisioner
      summary: Get Provisioner
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    - $ref: '#/components/parameters/provisionerNameOrID'
    post:
      description: Add a webhook to a provisioner.
      operationId: PostWebhooks
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/provisionerWebhook'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisionerWebhook'
          description: The new webhook.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '409':
          $ref: '#/components/responses/409'
        '412':
          $ref: '#/components/responses/412'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-webhooks
      summary: Create Provisioner Webhook
      tags:
      - PKI Architecture
  /authorities/{authorityID}/provisioners/{provisionerNameOrID}/webhooks/{webhookNameOrID}:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    - $ref: '#/components/parameters/provisionerNameOrID'
    - $ref: '#/components/parameters/webhookNameOrID'
    delete:
      description: Delete a single provisioner webhook by name or ID.
      operationId: DeleteWebhook
      responses:
        '204':
          $ref: '#/components/responses/204'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - delete-webhook
      summary: Delete Provisioner Webhook
      tags:
      - PKI Architecture
    get:
      description: Get a single provisioner webhook by name or ID.
      operationId: GetWebhook
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/provisionerWebhook'
          description: The requested webhook.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - get-webhook
      summary: Get Provisioner Webhook
      tags:
      - PKI Architecture
  /authorities/{authorityID}/root:
    parameters:
    - $ref: '#/components/parameters/requestID'
    - $ref: '#/components/parameters/version'
    - $ref: '#/components/parameters/accept'
    - $ref: '#/components/parameters/authorityID'
    post:
      description: 'Finalize creation of a new advanced Authority with external root by submitting the signed certificate for the CSR previously returned from the `/authorities/csr` endpoint.

        Also submit the root certificate and a name for the root.

        The authority will be ready to issue certificates after this operation completes.

        '
      operationId: PostAuthorityRoot
      requestBody:
        content:
          application/json:
            schema:
              properties:
                adminEmails:
                  description: Users that will have admin access to manage the authority
                  items:
                    pattern: ^[\w-.]+@[\w-.]+$
                    type: string
                  minItems: 1
                  type: array
                  uniqueItems: true
                id:
                  description: The `id` returned from a previous call to `/authorities/csr`
                  type: string
                intermediatePEM:
                  description: The signed intermediate certificate
                  type: string
                rootName:
                  description: A name for the external root issuer
                  type: string
                rootPEM:
                  description: The root certificate in PEM format
                  type: string
              required:
              - id
              - rootName
              - rootPEM
              - intermediatePEM
              - adminEmails
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/authority'
          description: The Authority that was updated
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            X-Smallstep-Api-Version:
              $ref: '#/components/headers/X-Smallstep-Api-Version'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404'
        '500':
          $ref: '#/components/responses/500'
      security:
      - JWT:
        - post-authority-root
      summary: Post Authority External Root
      tags:
      - PKI Architecture
components:
  schemas:
    x5cProvisioner:
      description: A [provisioner](https://smallstep.com/docs/step-ca/provisioners/#x5c---x509-certificate) that authenticates a certificate request with an existing X.509 certificate.
      properties:
        roots:
          description: A list of PEM-encoded X.509 certificates. Any certificate bundle that chains up to any of these roots can be used in a certificate request.
          items:
            type: string
          type: array
      required:
      - roots
      title: X5C Provisioner
      type: object
    azureAudience:
      description: Defaults to https://management.azure.com/ but it can be changed if necessary.
      title: Azure Audience
      type: string
    azureTenantID:
      description: The Azure account tenant ID for this provisioner. This ID is the Directory ID available in the Azure Active Directory properties.
      title: Azure Tenant ID
      type: string
    awsProvisioner:
      description: The [AWS provisioner](https://smallstep.com/docs/step-ca/provisioners/#aws) grants a certificate to an Amazon EC2 instance using the Instance Identity Document.
      properties:
        accounts:
          $ref: '#/components/schemas/awsAccounts'
        disableCustomSANs:
          $ref: '#/components/schemas/awsDisableCustomSANs'
        disableTrustOnFirstUse:
          description: By default only one certificate will be granted per instance, but if the option is set to `true` this limit is not set and different tokens can be used to get different certificates.
          type: boolean
        instanceAge:
          $ref: '#/components/schemas/instanceAge'
      required:
      - accounts
      title: AWS Provisioner
      type: object
    awsAccounts:
      description: The list of AWS account IDs that are allowed to use an AWS cloud provisioner.
      items:
        type: string
      title: AWS Accounts
      type: array
    gcpDisableCustomSANs:
      description: By default custom SANs are valid, but if this option is set to `true` only the SANs available in the instance identity document will be valid, these are the DNS `<instance-name>.c.<project-id>.internal` and `<instance-name>.<zone>.c.<project-id>.internal`.
      title: GCP Disable Custom SANs
      type: boolean
    azureResourceGroups:
      description: The list of resource group names that are allowed to use this provisioner.
      items:
        type: string
      title: Azure Resource Groups
      type: array
    distinguishedName:
      description: 'Name used in X.509 certificates

        '
      example:
      - organization: admins
      properties:
        commonName:
          type: string
        country:
          type: string
        emailAddress:
          type: string
        locality:
          type: string
        organization:
          type: string
        organizationalUnit:
          type: string
        postalCode:
          type: string
        province:
          type: string
        serialNumber:
          type: string
        streetAddress:
          type: string
      title: Distinguished Name
    azureProvisioner:
      description: The [Azure provisioner](https://smallstep.com/docs/step-ca/provisioners/#azure) grants certificates to Microsoft Azure instances using the managed identities tokens.
      properties:
        audience:
          $ref: '#/components/schemas/azureAudience'
        disableCustomSANs:
          $ref: '#/components/schemas/azureDisableCustomSANs'
        disableTrustOnFirstUse:
          description: By default only one certificate will be granted per instance, but if the option is set to true this limit is not set and different tokens can be used to get different certificates.
          type: boolean
        resourceGroups:
          $ref: '#/components/schemas/azureResourceGroups'
        tenantID:
          $ref: '#/components/schemas/azureTenantID'
      required:
      - tenantID
      - resourceGroups
      title: Azure Provisioner
      type: object
    scepProvisioner:
      description: The [SCEP provisioner](https://smallstep.com/docs/step-ca/provisioners/#scep) grants certificates to clients using the SCEP protocol. This type is currently experimental and subject to change.
      properties:
        autogenerateDecrypter:
          description: Automatically generate a new RSA decrypter instead of providing one.
          type: boolean
        challenge:
          description: A static challenge secret.
          type: string
        decrypterCertificate:
          description: A PEM-encoded certificate for an RSA public key.
          type: string
        decrypterKey:
          description: The PEM-encoded RSA private key, corresponding to the certificate public key.
          type: string
        decrypterKeyPassword:
          description: The password for the PEM-encoded RSA private key, if any.
          type: string
        encryptionAlgorithmIdentifier:
          default: AES_256_CBC
          description: "The encryption algorithm used for encrypting responses to the SCEP client:\n * `DES_CBC`    - [DES in CBC mode](https://www.rfc-editor.org/rfc/rfc8018.html#appendix-B.2.1) - `1.3.14.3.2.7`\n * `AES_128_CBC` - [AES-128 in CBC mode](https://www.rfc-editor.org/rfc/rfc8018.html#appendix-B.2.5) - `2.16.840.1.101.3.4.1.2`\n * `AES_128_GCM` - [AES-128 in GCM mode](https://www.rfc-editor.org/rfc/rfc5084.html#section-3.2) - `2.16.840.1.101.3.4.1.6`\n * `AES_256_CBC` - [AES-256 in CBC mode](https://www.rfc-editor.org/rfc/rfc3565.html#section-4.1) - `2.16.840.1.101.3.4.1.42`\n * `AES_256_GCM` - [AES-256 in GCM mode](https://www.rfc-editor.org/rfc/rfc5084.html#section-3.2) - `2.16.840.1.101.3.4.1.46`\n"
          enum:
          - DES_CBC
          - AES_128_CBC
          - AES_128_GCM
          - AES_256_CBC
          - AES_256_GCM
          type: string
        excludeIntermediate:
          default: false
          description: Exclude the intermediate CA certificate in SCEP responses.
          type: boolean
        forceCN:
          description: Force one of the SANs to become the Common Name, if a Common Name is not provided.
          type: boolean
        includeRoot:
          default: false
          description: Include the root CA certificate in SCEP responses.
          type: boolean
        minimumPublicKeyLength:
          default: 2048
          description: The minimum number of bits for RSA public keys accepted in SCEP requests.
          maximum: 8192
          minimum: 1
          multipleOf: 8
          type: integer
      title: SCEP Provisioner
      type: object
      x-experimental: true
    acmeAttestationProvisioner:
      description: A [provisioner](https://smallstep.com/docs/step-ca/provisioners/#acme) that enables automation with the [device-attest-01 challenge of the ACME protocol](https://smallstep.com/blog/acme-managed-device-attestation-explained/).
      properties:
        attestationFormats:
          description: The allowed attestation formats for the device-attest-01 challenge. Valid values are `apple`, `step`, and `tpm`. The apple format is for Apple devices, and adds trust for Apple's CAs. The step format is for non-TPM devices that can issue attestation certificates, such as YubiKey PIV. It adds trust for Yubico's root CA. The tpm format is for TPMs and does not trust any CAs by default.
          items:
            enum:
            - apple
            - step
            - tpm
            type: string
          minItems: 1
          type: array
          uniqueItems: true
        attestationRoots:
          description: A trust bundle of root certificates in PEM format that will be used to verify attestation certificates. The default value depends on the value of attestationFormats. If provided, this PEM bundle will override the CA trust established by setting attestationFormats to apple or step. At least one root certificate is required when using the tpm attestationFormat.
          items:
            type: string
          type: array
        forceCN:
          description: Force one of the SANs to become the Common Name, if a Common Name is not provided.
          type: boolean
        requireEAB:
          description: Only ACME clients that have been preconfigured with valid EAB credentials will be able to create an account with this provisioner.
          type: boolean
      required:
      - attestationFormats
      title: ACME Device Attestation Provisioner
      type: object
    provisioner:
      allOf:
      - properties:
          claims:
            $ref: '#/components/schemas/provisionerClaims'
          createdAt:
            description: Timestamp of when the provisioner was created in RFC 3339 format. Generated server-side.
            format: date-time
            type: string
          id:
            description: A UUID identifying this provisioner. Generated server-side when the provisioner is created.
            type: string
          name:
            description: The name of the provisioner.
            type: string
          options:
            $ref: '#/components/schemas/provisionerOptions'
          type:
            description: The type of provisioner.
            enum:
            - OIDC
            - JWK
            - ACME
            - ACME_ATTESTATION
            - X5C
            - AWS
            - GCP
            - AZURE
            - SCEP
            type: string
        required:
        - type
        - name
        type: object
      - oneOf:
        - $ref: '#/components/schemas/oidcProvisioner'
        - $ref: '#/components/schemas/jwkProvisioner'
        - $ref: '#/components/schemas/acmeProvisioner'
        - $ref: '#/components/schemas/acmeAttestationProvisioner'
        - $ref: '#/components/schemas/x5cProvisioner'
        - $ref: '#/components/schemas/awsProvisioner'
        - $ref: '#/components/schemas/gcpProvisioner'
        - $ref: '#/components/schemas/azureProvisioner'
        - $ref: '#/components/schemas/scepProvisioner'
      description: '[Provisioners](https://smallstep.com/docs/step-ca/provisioners/) are methods of using the CA to get certificates with different modes of authorization.'
      examples:
      - createdAt: '2022-08-24T14:15:22Z'
        encryptedKey: eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoibHRFWUl6eV9pa2JYa1FiUEY0QkhzdyJ9.SQtT3TVE-IXfB45aK9QUPPS2LJqXwJwiAFDNOuzvHISFKDwfrDlWkQ.h3aQ8zDpqvAUTAI7.KqGW-T_VJ8IxxIKkHthLO8g4V42nIVsN9qPYt3VlQxI5O0XiGzqClY5e3-nyfGX_bfWeXmLEKUckwnfFOAaOSNvnI2SN2Z169cvaGaNNCpdZxw-o3V1cBPB87dtah7dP78nMsVhfKDXrajxcebrVDED43LgHHScQM-_h6gf3PazBzmKBsfHhKd7juO0v2N6exil-Dsbrkon6nSHbl6b7P738LrbTg_OdCE_ZE1XaL6ediUnWTiExCkyDO4kyUqZzus3Lf-6cc26pGhfrnIkbl5t6cdcXnc-l4Tv6vgDiZkYqpAEMaKEfTN9mQ7gjjq3EetZZK0D5oLGuPw_cmuw.o2KnkzsmDkNL8XQBvLS3Lw
        id: 4d7eb290-cd0f-4aa1-ba95-7caf4adf8fac
        key:
          alg: ES256
          crv: P-256
          kid: oqEw3DFB5qaapdTrqk_opzRFDXGaMTBF9IfuWf4roiM
          kty: EC
          use: sig
          x: YApMu7eAKAmfLNigtS3tlt8F3mc4xYccunApQG7ivCw
          y: HQgIBZ-Oc0tAXTj7Yme9hLVQCrp3ufokmm1tcq9Ou0g
        name: My JWK Provisioner
        type: JWK
      - admins:
        - eng@smallstep.com
        createdAt: '2023-04-24T14:15:22Z'
        domains:
        - smallstep.com
        groups:
        - eng
        id: 5d185312-f6c0-4426-8af2-d10b6548dcaf
        listenAddress: :10000
        name: My OIDC Provisioner
        type: OIDC
      - id: c37b052b-6150-487c-b59c-0d8c1ecde6af
        name: My X5C Provisioner
        roots:
        - '-----BEGIN CERTIFICATE -----...-----END CERTIFICATE -----'
        type: X5C
      - challenges:
        - http-01
        - dns-01
        - tls-alpn-01
        forceCN: false
        id: cfb348f2-f5f0-4993-9482-5d4e760a130e
        name: My ACME provisioner
        requireEAB: true
        type: ACME
      - attestationFormats:
        - tpm
        attestationRoots:
        - '-----BEGIN CERTIFICATE -----...-----END CERTIFICATE -----'
        forceCN: true
        id: 277246b0-2b2e-4309-bb54-4e4f6ff2db3d
        name: My TPM Attestation Provisioner
        requireEAB: false
        type: ACME_ATTESTATION
      - attestationFormats:
        - step
        - apple
        forceCN: true
        id: 53f8882a-d3d3-4dee-a22b-3ae3a7960fbe
        name: My Attestation Provisioner
        requireEAB: false
        type: ACME_ATTESTATION
      - accounts:
        - '1234567890'
        disableCustomSANs: true
        disableTrustOnFirstUse: true
        id: 040f3459-d3c8-4b49-bb57-2c56b0311d73
        instanceAge: 5m0s
        name: My AWS Provisioner
        type: AWS
      - disableCustomSANs: true
        disableTrustOnFirstUse: true
        id: 97dbea31-f611-42d0-945e-3fb54e10117a
        instanceAge: 5m0s
        name: My GCP Provisioner
        projectIDs:
        - pki-5678
        serviceAccounts:
        - 1234567890-compute@developer.gserviceaccount.com
        - 9876543210-compute@developer.gserviceaccount.com
        type: GCP
      - disableCustomSANs: true
        disableTrustOnFirstUse: true
        id: 6fab7d9c-5cfe-44bc-9829-493ea99721b5
        name: My Azure Provisioner
        resourceGroups:
        - pki-789
        tenantID: a8445e46-cb1f-4866-ae0a-e20135b75b1f
        type: AZURE
      - challenge: my-super-long-and-secret-challenge-value
        decrypterCertificate: "-----BEGIN CERTIFICATE-----\n ... \n-----END CERTIFICATE-----\n"
        decrypterKeyPEM: "-----BEGIN RSA PRIVATE KEY -----\n  ...\n-----END RSA PRIVATE KEY -----\n"
        decrypterKeyPassword: the-secret-decrypter-key-password
        encryptionAlgorithmIdentifier: 2
        excludeIntermediate: false
        forceCN: false
        id: 657be70c-c76c-4cd2-848a-c71a921e74bb
        includeRoot: false
        minimumPublicKeyLength: 2048
        name: My SCEP Provisioner
        type: SCEP
      title: Provisioner
    nameConstraints:
      description: X.509 certificate name constraints.
      properties:
        critical:
          description: 'Whether or not name constraints are marked critical.

            '
          type: boolean
        excludedDNSDomains:
          items:
            type: string
          type: array
        excludedEmailAddresses:
          items:
            type: string
          type: array
        excludedIPRanges:
          items:
            type: string
          type: array
        excludedURIDomains:
          items:
            type: string
          type: array
        permittedDNSDomains:
          items:
            type: string
          type: array
        permittedEmailAddresses:
          items:
            type: string
          type: array
        permittedIPRanges:
          items:
            type: string
          type: array
        permittedURIDomains:
          items:
            type: string
          type: array
      title: Name Constraints
    acmeProvisioner:
      description: A [provisioner](https://smallstep.com/docs/step-ca/provisioners/#acme) that enables automation with the [ACME protocol](https://smallstep.com/docs/step-ca/acme-basics/#acme-challenges).
      properties:
        challenges:
          description: Wh

# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/smallstep/refs/heads/main/openapi/smallstep-pki-architecture-api-openapi.yml