Venafi Workload Identity Manager Sub CA Providers API
The Workload Identity Manager Sub CA Providers API from Venafi — 2 operation(s) for workload identity manager sub ca providers.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/venafi-workload-identity-manager-sub-ca-providers-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Certificate Manager - SaaS Workload Identity Manager Sub CA…
version: '1.0'
servers:
- description: US Region
url: https://api.venafi.cloud
- description: EU Region
url: https://api.eu.venafi.cloud
- description: AU Region
url: https://api.au.venafi.cloud
- description: UK Region
url: https://api.uk.venafi.cloud
- description: SG Region
url: https://api.sg.venafi.cloud
- description: CA Region
url: https://api.ca.venafi.cloud
tags:
- name: Workload Identity Manager Sub CA Providers
paths:
/v1/distributedissuers/subcaproviders:
post:
description: Creates a sub ca provider
operationId: subcaproviders_create
requestBody:
content:
application/json:
examples:
An example for creation of new sub CA provider.:
description: An example for creation of new sub CA provider.
value:
caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a
caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
commonName: example.com
country: US
keyAlgorithm: EC_P256
locality: San Antonio
name: Some Sub CA
organization: Some organization
organizationalUnit: Some organizational unit
stateOrProvince: Texas
validityPeriod: P30D
schema:
$ref: '#/components/schemas/SubCAProviderCreateRequest'
description: Details of the new sub CA provider.
required: true
responses:
'201':
content:
application/json:
examples:
Details of the created sub CA provider.:
description: Details of the created sub CA provider.
summary: Details of the created sub CA provider.
value:
caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a
caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
caType: BUILTIN
commonName: example.com
companyId: 03eb6e61-9806-11ed-84f2-c747fb71e467
country: US
creationDate: '2022-10-10T14:50:41.71Z'
id: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
keyAlgorithm: EC_P256
locality: San Antonio
modificationDate: '2023-12-12T20:00:10.5Z'
name: Some Sub CA
organization: Some organization
organizationalUnit: Some organizational unit
stateOrProvince: Texas
validityPeriod: P30D
schema:
$ref: '#/components/schemas/SubCAProviderGetResponse'
description: Sub CA Provider was created; details in response body;
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: "The request was rejected. Possible causes, by error code:\n- 10006: Malformed JSON body or an unknown/unrecognized field; or sharing\n is requested outside a Strata context or with both `shareWithAll` and\n `sharedWithSubTsgIds` set.\n- 50301: `name` is empty.\n- 50302: `caAccountId` is missing.\n- 50303: `caProductOptionId` is missing.\n- 50304: `validityPeriod` is empty or not a valid ISO-8601 period.\n- 50305: `commonName` is empty.\n- 50306: `keyAlgorithm` is empty.\n- 50308: `caType` is not a supported Sub CA type.\n- 50310: `caType` is empty.\n- 50311: A Sub CA provider with the same `name` already exists.\n- 50312: `name` is longer than 64 characters.\n- 50313: `commonName` is longer than 64 characters.\n- 50314: `organization` is longer than 64 characters.\n- 50315: `organizationalUnit` is longer than 64 characters.\n- 50316: `locality` is longer than 64 characters.\n- 50317: `stateOrProvince` is longer than 64 characters.\n- 50318: `country` is longer than 64 characters.\n- 50319: When signing is enabled, the PKCS11 partition label is empty or\n longer than 32 characters, or the PIN is empty.\n- 50320: A PKCS11 allowed client library is not a 64-character SHA-256 hash.\n- 50321: The PKCS11 partition serial number is not up to 18 numeric/hex characters.\n- 50322: A sub-TSG id is not a 10-digit number starting with 1."
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The request was forbidden. Possible causes, by error code:
- 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.'
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The referenced entity was not found. Possible causes, by error code:
- 50307: The referenced CA account does not exist (or belongs to another tenant).
- 50309: The referenced CA product option does not exist on that CA account.'
security:
- tppl-api-key: []
summary: Create a new Sub CA provider
tags:
- Workload Identity Manager Sub CA Providers
x-rbac:
permissions:
access_type: write
description: Ability to create sub CA provider
name: ngts.sub_ca_provider.create
roles:
- PKIAdmin
get:
description: Returns a list of all the subordinate CA providers along with their details.
operationId: subcaproviders_getAll
responses:
'200':
content:
application/json:
examples:
The details of the Sub CA providers.:
description: The details of the Sub CA providers.
summary: The details of the Sub CA providers.
value:
subCaProviders:
- caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a
caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
caType: BUILTIN
commonName: example.com
companyId: 03eb6e61-9806-11ed-84f2-c747fb71e467
country: US
creationDate: '2022-10-10T14:50:41.71Z'
id: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
keyAlgorithm: EC_P256
locality: San Antonio
modificationDate: '2023-12-12T20:00:10.5Z'
name: Some Sub CA
organization: Some organization
organizationalUnit: Some organizational unit
stateOrProvince: Texas
validityPeriod: P30D
schema:
$ref: '#/components/schemas/SubCAProviderListResponse'
description: All Sub CA providers with details.
security:
- tppl-api-key: []
summary: Get the details of all Sub CA providers
tags:
- Workload Identity Manager Sub CA Providers
x-rbac:
permissions:
access_type: read
description: Ability to get sub CA provider
name: ngts.sub_ca_provider.get
roles:
- PKIAdmin
- PlatformAdmin
- ResourceOwner
- Guest
/v1/distributedissuers/subcaproviders/{id}:
get:
description: Retrieves the details of the subordinate CA provider that has the specified `id`.
operationId: subcaproviders_getById
parameters:
- description: Sub CA provider UUID
in: path
name: id
required: true
schema:
format: uuid
type: string
responses:
'200':
content:
application/json:
examples:
Details of the sub CA provider.:
description: Details of the sub CA provider.
summary: Details of the sub CA provider.
value:
caAccountId: 4ece3180-b1e0-11ed-862d-ad36b18e787a
caProductOptionId: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
caType: BUILTIN
commonName: example.com
companyId: 03eb6e61-9806-11ed-84f2-c747fb71e467
country: US
creationDate: '2022-10-10T14:50:41.71Z'
id: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
keyAlgorithm: EC_P256
locality: San Antonio
modificationDate: '2023-12-12T20:00:10.5Z'
name: Some Sub CA
organization: Some organization
organizationalUnit: Some organizational unit
stateOrProvince: Texas
validityPeriod: P30D
schema:
$ref: '#/components/schemas/SubCAProviderGetResponse'
description: Specified sub CA provider found; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The request was rejected. Possible causes, by error code:
- 10055: The `id` path parameter is not a valid UUID.'
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The referenced entity was not found. Possible causes, by error code:
- 10051: No Sub CA provider with the given `id` exists in this tenant.'
security:
- tppl-api-key: []
summary: Get a Sub CA provider's details
tags:
- Workload Identity Manager Sub CA Providers
x-rbac:
permissions:
access_type: read
description: Ability to get sub CA provider
name: ngts.sub_ca_provider.get
roles:
- PKIAdmin
- PlatformAdmin
- ResourceOwner
- Guest
patch:
description: Updates (replaces) details of the subordinate CA provider that has the specified `id`. Only fields specified in the request will be updated.
operationId: subcaproviders_update
parameters:
- description: Sub CA provider UUID
in: path
name: id
required: true
schema:
format: uuid
type: string
requestBody:
content:
application/json:
examples:
An example for updating some details of a Sub CA provider.:
description: An example for updating some details of a Sub CA provider.
value:
locality: Chicago
stateOrProvince: Illinois
schema:
$ref: '#/components/schemas/SubCAProviderUpdateRequest'
description: Sub CA provider's details to update.
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/SubCAProviderGetResponse'
description: Sub CA provider updated; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: "The request was rejected. Supplied fields are validated with the same\nrules as on create. Possible causes, by error code:\n- 10006: Malformed JSON body or an unknown/unrecognized field; or sharing\n is requested outside a Strata context or with both `shareWithAll` and\n `sharedWithSubTsgIds` set.\n- 10055: The `id` path parameter is not a valid UUID.\n- 50301: `name` is empty.\n- 50304: `validityPeriod` is not a valid ISO-8601 period.\n- 50305: `commonName` is empty.\n- 50311: A different Sub CA provider with the same `name` already exists.\n- 50312: `name` is longer than 64 characters.\n- 50313: `commonName` is longer than 64 characters.\n- 50314: `organization` is longer than 64 characters.\n- 50315: `organizationalUnit` is longer than 64 characters.\n- 50316: `locality` is longer than 64 characters.\n- 50317: `stateOrProvince` is longer than 64 characters.\n- 50318: `country` is longer than 64 characters.\n- 50319: When signing is enabled, the PKCS11 partition label is empty or\n longer than 32 characters, or the PIN is empty.\n- 50320: A PKCS11 allowed client library is not a 64-character SHA-256 hash.\n- 50321: The PKCS11 partition serial number is not up to 18 numeric/hex characters.\n- 50322: A sub-TSG id is not a 10-digit number starting with 1.\n- 50247: HSM signing cannot be enabled because the Sub CA provider is\n referenced by one or more forward-trust proxy configurations."
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The request was forbidden. Possible causes, by error code:
- 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.'
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: "The referenced entity was not found. Possible causes, by error code:\n- 10051: No Sub CA provider with the given `id` exists in this tenant.\n- 50307: When `caProductOptionId` is changed, the referenced CA account\n does not exist (or belongs to another tenant).\n- 50309: When `caProductOptionId` is changed, the referenced CA product\n option does not exist on that CA account."
security:
- tppl-api-key: []
summary: Update a Sub CA provider's details
tags:
- Workload Identity Manager Sub CA Providers
x-rbac:
permissions:
access_type: write
description: Ability to update sub CA provider
name: ngts.sub_ca_provider.update
roles:
- PKIAdmin
delete:
description: Deletes the subordinate CA provider that has the specified `id`.
operationId: subcaproviders_delete
parameters:
- description: Sub CA provider UUID
in: path
name: id
required: true
schema:
format: uuid
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/SubCAProviderDeleteResponse'
description: Specified Sub CA provider was deleted.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: "The request was rejected. Possible causes, by error code:\n- 10055: The `id` path parameter is not a valid UUID.\n- 50300: The Sub CA provider cannot be deleted because it is still\n referenced by one or more Issuer configurations; the response lists the\n blocking configuration ids."
'403':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The request was forbidden. Possible causes, by error code:
- 1002: The operation is restricted to the primary TSG; sub-TSG callers are rejected.'
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse3'
description: 'The referenced entity was not found. Possible causes, by error code:
- 10051: No Sub CA provider with the given `id` exists in this tenant.'
security:
- tppl-api-key: []
summary: Remove a Sub CA provider
tags:
- Workload Identity Manager Sub CA Providers
x-rbac:
permissions:
access_type: write
description: Ability to delete sub CA provider
name: ngts.sub_ca_provider.delete
roles:
- PKIAdmin
components:
schemas:
SubCAProviderDeleteResponse:
properties:
id:
description: UUID of the Sub CA provider
example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
format: uuid
type: string
name:
description: Name of the Sub CA provider
example: Some Sub CA
type: string
type: object
SubCAProviderGetResponse:
properties:
caAccountId:
description: UUID of the CA account used by this Sub CA provider
example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
format: uuid
type: string
caProductOptionId:
description: UUID of the CA product option used by this Sub CA provider
example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
format: uuid
type: string
caType:
$ref: '#/components/schemas/CAType'
commonName:
description: Common name
example: example.com
type: string
companyId:
description: UUID specific to your company
example: 03eb6e61-9806-11ed-84f2-c747fb71e467
format: uuid
type: string
country:
description: Country
example: US
type: string
creationDate:
description: When the Sub CA provider was initially created
example: '2022-10-10T14:50:41.71Z'
format: date-time
type: string
id:
description: UUID of the Sub CA provider
example: 2f3c6030-b1e0-11ed-a3ed-e3dbaf56a746
format: uuid
type: string
keyAlgorithm:
$ref: '#/components/schemas/KeyAlgorithm1'
locality:
description: Locality
example: San Antonio
type: string
modificationDate:
description: When the Sub CA provider was last modified
example: '2023-12-12T20:00:10.5Z'
format: date-time
type: string
name:
description: Name of the Sub CA provider
example: Some Sub CA provider
type: string
organization:
description: Organization
example: Some organization
type: string
organizationalUnit:
description: Organizational unit
example: Some organizational unit
type: string
pkcs11:
$ref: '#/components/schemas/SubCAProviderPKCS11Configuration'
shareWithAll:
description: Shared with all sub-TSGs
example: false
type: boolean
sharedWithSubTsgIds:
items:
description: Sub-TSG IDs this SubCA provider is shared with
type: string
type: array
uniqueItems: true
stateOrProvince:
description: State or province
example: Texas
type: string
validityPeriod:
description: ISO8601 Period Format
example: P30D
format: PnYnMnDTnHnMnS
type: string
type: object
ErrorResponse3:
properties:
errors:
items:
$ref: '#/components/schemas/Error1'
type: array
type: object
SubCAProviderCreateRequest:
allOf:
- $ref: '#/components/schemas/SubCAProviderUpdateRequest'
- properties:
caAccountId:
description: UUID of the CA account used by this Sub CA provider
example: 4ece3180-b1e0-11ed-862d-ad36b18e787a
format: uuid
type: string
caType:
$ref: '#/components/schemas/CAType'
required:
- caAccountId
- caProductOptionId
- caType
- commonName
- keyAlgorithm
- name
- validityPeriod
type: object
SubCAProviderPKCS11Configuration:
properties:
allowedClientLibraries:
description: A collection of strings each of which represents SHA256 hash of an allowed HSM client library
example:
- c34d199f2e30bb679cd9b8533b99975465aefe8b023be1b37972f1ab43ab7b2d
items:
type: string
type: array
partitionLabel:
description: HSM Partition Label
example: workload-identity-manager-hsm-partition
type: string
partitionSerialNumber:
description: HSM Partition Serial Number
example: '1444210958933'
pattern: ^[A-Fa-fx0-9]{0,18}$
type: string
pin:
description: HSM PIN
example: '1234'
type: string
writeOnly: true
signingEnabled:
description: Indicates whether HSM signing is enabled or not
example: true
type: boolean
type: object
CAType:
description: Type of CA this Sub CA provider works with
enum:
- MOCKCA
- DIGICERT
- GLOBALSIGN
- BUILTIN
- ENTRUST
- MICROSOFT
- ACME
- ZTPKI
- GLOBALSIGNMSSL
- TPP
example: BUILTIN
type: string
Error1:
description: A single error. The numeric `code` is stable and matches the codes listed at the start of each cause in the endpoints' error-response descriptions, so clients can branch on it instead of parsing `message`.
properties:
args:
description: Positional values interpolated into the message (e.g. the offending field value or entity id).
items:
type: object
type: array
code:
description: Stable numeric error code identifying the specific failure.
format: int32
type: integer
message:
description: Human-readable description of the error.
type: string
type: object
KeyAlgorithm1:
description: Key algorithm type
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_P256
- EC_P384
- EC_P521
- EC_ED25519
example: EC_P256
type: string
SubCAProviderListResponse:
properties:
subCaProviders:
items:
$ref: '#/components/schemas/SubCAProviderGetResponse'
type: array
type: object
SubCAProviderUpdateRequest:
properties:
caProductOptionId:
description: UUID of the CA product option used by this Sub CA provider
example: 6b3d8d20-b1e0-11ed-9c2f-953e35982bbd
format: uuid
type: string
commonName:
description: Common name
example: example.com
maxLength: 64
type: string
country:
description: Country
example: US
maxLength: 64
type: string
keyAlgorithm:
$ref: '#/components/schemas/KeyAlgorithm1'
locality:
description: Locality
example: San Antonio
maxLength: 64
type: string
name:
description: Name of the Sub CA provider
example: Some Sub CA
maxLength: 64
type: string
organization:
description: Organization
example: Some organization
maxLength: 64
type: string
organizationalUnit:
description: Organizational unit
example: Some organizational unit
maxLength: 64
type: string
pkcs11:
$ref: '#/components/schemas/SubCAProviderPKCS11Configuration'
shareWithAll:
description: Share with all sub-TSGs
type: boolean
sharedWithSubTsgIds:
example:
- '1378242802'
- '1896239460'
items:
description: Specific sub-TSG IDs to share with
type: string
type: array
stateOrProvince:
description: State or province
example: Texas
maxLength: 64
type: string
validityPeriod:
description: ISO8601 Period Format
example: P30D
format: PnYnMnDTnHnMnS
type: string
type: object
securitySchemes:
service-account:
in: header
name: service-account
type: apiKey
tppl-api-key:
in: header
name: tppl-api-key
type: apiKey
x-readme:
samples-languages:
- curl
- go
- java
- javascript
- node
- python