github.com/go-swagger/go-swagger@v0.31.0/fixtures/bugs/2919/edge-api/client/enroll.yml (about)

     1  ---
     2  paths:
     3    enroll:
     4      parameters:
     5        - $ref: '../shared/parameters.yml#/token-optional'
     6      post:
     7        summary: Legacy enrollment endpoint
     8        description: endpoint defers to the logic in the more specific `enroll/*` endpoints
     9        operationId: enroll
    10        tags:
    11          - Enroll
    12        consumes:
    13          - application/pkcs10
    14          - application/json
    15          - application/x-pem-file
    16          - text/plain
    17        produces:
    18          #default to PEM for older clients that do not properly set/inspect accept/content-type headers
    19          - application/x-pem-file
    20          - application/json
    21        responses:
    22          '200':
    23            $ref: '../shared/standard-responses.yml#/responses/emptyResponse'
    24          '404':
    25            $ref: '../shared/standard-responses.yml#/responses/notFoundResponse'
    26    enroll-ca:
    27      post:
    28        summary: Enroll an identity with a pre-exchanged certificate
    29        description: |
    30          For CA auto enrollment, an identity is not created beforehand.
    31          Instead one will be created during enrollment. The client will present a client certificate that is signed by a
    32          Certificate Authority that has been added and verified (See POST /cas and POST /cas/{id}/verify).
    33  
    34          During this process no CSRs are requires as the client should already be in possession of a valid certificate.
    35        operationId: enrollCa
    36        tags:
    37          - Enroll
    38        responses:
    39          '200':
    40            $ref: '../shared/standard-responses.yml#/responses/emptyResponse'
    41          '404':
    42            $ref: '../shared/standard-responses.yml#/responses/notFoundResponse'
    43    enroll-ott:
    44      parameters:
    45        - $ref: '../shared/parameters.yml#/token'
    46      post:
    47        summary: Enroll an identity via one-time-token
    48        description: |
    49          Enroll an identity via a one-time-token which is supplied via a query string parameter. This enrollment method
    50          expects a PEM encoded CSRs to be provided for fulfillment. It is up to the enrolling identity to manage the
    51          private key backing the CSR request.
    52        operationId: enrollOtt
    53        tags:
    54          - Enroll
    55        consumes:
    56          - application/pkcs10
    57        produces:
    58          - application/x-x509-user-cert
    59        responses:
    60          '200':
    61            $ref: '#/responses/zitiSignedCert'
    62          '404':
    63            $ref: '../shared/standard-responses.yml#/responses/notFoundResponse'
    64    enroll-ottca:
    65      parameters:
    66        - $ref: '../shared/parameters.yml#/token'
    67      post:
    68        summary: Enroll an identity via one-time-token with a pre-exchanged client certificate
    69        description: |
    70          Enroll an identity via a one-time-token that also requires a pre-exchanged client certificate to match a
    71          Certificate Authority that has been added and verified (See POST /cas and POST /cas{id}/verify). The client
    72          must present a client certificate signed by CA associated with the enrollment. This enrollment is similar to
    73          CA auto enrollment except that is required the identity to be pre-created.
    74  
    75          As the client certificate has been pre-exchanged there is no CSR input to this enrollment method.
    76        operationId: enrollOttCa
    77        tags:
    78          - Enroll
    79        responses:
    80          '200':
    81            $ref: '../shared/standard-responses.yml#/responses/emptyResponse'
    82    enroll-updb:
    83      parameters:
    84        - $ref: '../shared/parameters.yml#/token'
    85      post:
    86        summary: Enroll an identity via one-time-token
    87        description: |
    88          Enrolls an identity via a one-time-token to establish an initial username and password combination
    89        operationId: ernollUpdb
    90        tags:
    91          - Enroll
    92        responses:
    93          '200':
    94            $ref: '../shared/standard-responses.yml#/responses/emptyResponse'
    95          '404':
    96            $ref: '../shared/standard-responses.yml#/responses/notFoundResponse'
    97    enroll-erott:
    98      parameters:
    99        - $ref: '../shared/parameters.yml#/token'
   100      post:
   101        summary: Enroll an edge-router
   102        description: |
   103          Enrolls an edge-router via a one-time-token to establish a certificate based identity.
   104        operationId: enrollErOtt
   105        tags:
   106          - Enroll
   107        responses:
   108          '200':
   109            $ref: '#/responses/erottResponse'
   110    enroll-extend-router:
   111      post:
   112        summary: Extend the life of a currently enrolled router's certificates
   113        description: |
   114          Allows a router to extend its certificates' expiration date by
   115          using its current and valid client certificate to submit a CSR. This CSR may
   116          be passed in using a new private key, thus allowing private key rotation or swapping.
   117  
   118          After completion any new connections must be made with certificates returned from a 200 OK
   119          response. The previous client certificate is rendered invalid for use with the controller even if it
   120          has not expired.
   121  
   122          This request must be made using the existing, valid, client certificate.
   123        operationId: extendRouterEnrollment
   124        parameters:
   125          - name: routerExtendEnrollmentRequest
   126            in: body
   127            required: true
   128            schema:
   129              $ref: '#/definitions/routerExtendEnrollmentRequest'
   130        tags:
   131          - Enroll
   132          - Extend Enrollment
   133        responses:
   134          '200':
   135            $ref: '#/responses/routerExtendEnrollmentResponse'
   136          '401':
   137            $ref: '../shared/standard-responses.yml#/responses/unauthorizedResponse'
   138  
   139  responses:
   140    erottResponse:
   141      description: A response containing the edge routers signed certificates (server chain, server cert, CAs).
   142      schema:
   143        $ref: '#/definitions/enrollmentCertsEnvelope'
   144    routerExtendEnrollmentResponse:
   145      description: A response containg the edge routers new signed certificates (server chain, server cert, CAs).
   146      schema:
   147        $ref: '#/definitions/enrollmentCertsEnvelope'
   148    zitiSignedCert:
   149      description: A PEM encoded certificate signed by the internal Ziti CA
   150      schema:
   151        type: string
   152      examples:
   153        application/x-x509-user-cert: |
   154          -----BEGIN CERTIFICATE-----
   155          MIICzDCCAlGgAwIBAgIRAPkVg1jVKqnNGFpSB3lPbaIwCgYIKoZIzj0EAwIwXjEL
   156          MAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5DMRMwEQYDVQQKDApOZXRGb3VuZHJ5MS0w
   157          KwYDVQQDDCROZXRGb3VuZHJ5IFppdGkgRXh0ZXJuYWwgQVBJIFJvb3QgQ0EwHhcN
   158          MTgxMTE1MTI1NzE3WhcNMTkxMTI1MTI1NzE3WjBrMQswCQYDVQQGEwJVUzELMAkG
   159          A1UECAwCTkMxEjAQBgNVBAcMCUNoYXJsb3R0ZTETMBEGA1UECgwKTmV0Rm91bmRy
   160          eTEPMA0GA1UECwwGQWR2RGV2MRUwEwYDVQQDDAxaaXRpQ2xpZW50MDEwdjAQBgcq
   161          hkjOPQIBBgUrgQQAIgNiAATTl2ft+/K9RvDgki9gSr9udNcV2bxD4LrWEdCdXNzF
   162          iVUiEcEte9z/M0JRt8lgo17OjFvS+ecrAmLtIZNmQnH3+9YeafjeNPpvQsMKxlTN
   163          MnU7Hka11GHc6swQZSyHvlKjgcUwgcIwCQYDVR0TBAIwADARBglghkgBhvhCAQEE
   164          BAMCBaAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIENsaWVudCBD
   165          ZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUtx+Tej6lSYdjb8Jbc2QuvoEsI/swHwYDVR0j
   166          BBgwFoAUcdTlRrnP43ZbQ3PGAbZMPE26+H4wDgYDVR0PAQH/BAQDAgXgMB0GA1Ud
   167          JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAKBggqhkjOPQQDAgNpADBmAjEAuXDS
   168          H7KKMr+la+Yuh8d8Q9cLtXzdS0j6a8e7iOyPJmdWq2WuzNdbCfAfLgKXuxhSAjEA
   169          sadZrXl1OBv11RGAKdYBIyRmfYUotCFAtCNKcfgBUxci0TDaKDA7r3jnjKT1d7Fs
   170          -----END CERTIFICATE-----
   171  
   172  definitions:
   173    enrollmentCertsEnvelope:
   174      type: object
   175      properties:
   176        meta:
   177          $ref: '../shared/standard-responses.yml#/definitions/meta'
   178        data:
   179          $ref: '#/definitions/enrollmentCerts'
   180    enrollmentCerts:
   181      type: object
   182      properties:
   183        serverCert:
   184          type: string
   185          description: A PEM encoded set of certificates to use as the servers chain
   186        cert:
   187          type: string
   188          description: A PEM encoded cert for the server
   189        ca:
   190          type: string
   191          description: A PEM encoded set of CA certificates to trust
   192    routerExtendEnrollmentRequest:
   193      type: object
   194      required:
   195        - serverCertCsr
   196        - certCsr
   197      properties:
   198        serverCertCsr:
   199          type: string
   200        certCsr:
   201          type: string