@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +55 -1
- package/dist/api/operations.d.ts +49 -0
- package/dist/api/operations.d.ts.map +1 -0
- package/dist/api/operations.js +175 -0
- package/dist/api/operations.js.map +1 -0
- package/dist/api/schema.d.ts +71 -0
- package/dist/api/schema.d.ts.map +1 -0
- package/dist/api/schema.js +107 -0
- package/dist/api/schema.js.map +1 -0
- package/dist/api/v3/index.d.ts.map +1 -1
- package/dist/api/v3/index.js +25 -212
- package/dist/api/v3/index.js.map +1 -1
- package/dist/api/v3/schema.d.ts +30 -74
- package/dist/api/v3/schema.d.ts.map +1 -1
- package/dist/api/v3/schema.js +18 -73
- package/dist/api/v3/schema.js.map +1 -1
- package/dist/api/v4/index.d.ts +8 -0
- package/dist/api/v4/index.d.ts.map +1 -0
- package/dist/api/v4/index.js +155 -0
- package/dist/api/v4/index.js.map +1 -0
- package/dist/api/v4/schema.d.ts +268 -0
- package/dist/api/v4/schema.d.ts.map +1 -0
- package/dist/api/v4/schema.js +182 -0
- package/dist/api/v4/schema.js.map +1 -0
- package/dist/certificate.d.ts +9 -6
- package/dist/certificate.d.ts.map +1 -1
- package/dist/certificate.js +55 -99
- package/dist/certificate.js.map +1 -1
- package/dist/db/index.d.ts +32 -24
- package/dist/db/index.d.ts.map +1 -1
- package/dist/db/index.js +101 -28
- package/dist/db/index.js.map +1 -1
- package/dist/db/migrations/0002_krl_version.d.ts +3 -0
- package/dist/db/migrations/0002_krl_version.d.ts.map +1 -0
- package/dist/db/migrations/0002_krl_version.js +15 -0
- package/dist/db/migrations/0002_krl_version.js.map +1 -0
- package/dist/db/migrations/index.d.ts.map +1 -1
- package/dist/db/migrations/index.js +3 -1
- package/dist/db/migrations/index.js.map +1 -1
- package/dist/db/types.d.ts +37 -0
- package/dist/db/types.d.ts.map +1 -0
- package/dist/db/types.js +13 -0
- package/dist/db/types.js.map +1 -0
- package/dist/krl.d.ts +9 -1
- package/dist/krl.d.ts.map +1 -1
- package/dist/krl.js +22 -162
- package/dist/krl.js.map +1 -1
- package/dist/proof.d.ts +36 -7
- package/dist/proof.d.ts.map +1 -1
- package/dist/proof.js +53 -21
- package/dist/proof.js.map +1 -1
- package/dist/router.d.ts.map +1 -1
- package/dist/router.js +3 -1
- package/dist/router.js.map +1 -1
- package/dist/ssh/certificate.d.ts +93 -0
- package/dist/ssh/certificate.d.ts.map +1 -0
- package/dist/ssh/certificate.js +178 -0
- package/dist/ssh/certificate.js.map +1 -0
- package/dist/ssh/encoding.d.ts +41 -0
- package/dist/ssh/encoding.d.ts.map +1 -0
- package/dist/ssh/encoding.js +70 -0
- package/dist/ssh/encoding.js.map +1 -0
- package/dist/ssh/keys.d.ts +80 -0
- package/dist/ssh/keys.d.ts.map +1 -0
- package/dist/ssh/keys.js +249 -0
- package/dist/ssh/keys.js.map +1 -0
- package/dist/ssh/signer.d.ts +35 -0
- package/dist/ssh/signer.d.ts.map +1 -0
- package/dist/ssh/signer.js +99 -0
- package/dist/ssh/signer.js.map +1 -0
- package/dist/types.d.ts +12 -17
- package/dist/types.d.ts.map +1 -1
- package/dist/utils.d.ts +40 -21
- package/dist/utils.d.ts.map +1 -1
- package/dist/utils.js +87 -54
- package/dist/utils.js.map +1 -1
- package/openapi.json +1960 -82
- package/package.json +5 -17
- package/src/api/operations.ts +211 -0
- package/src/api/schema.ts +137 -0
- package/src/api/v3/index.ts +32 -259
- package/src/api/v3/schema.ts +34 -96
- package/src/api/v4/index.ts +265 -0
- package/src/api/v4/schema.ts +235 -0
- package/src/certificate.ts +62 -123
- package/src/db/index.ts +113 -49
- package/src/db/migrations/0002_krl_version.ts +16 -0
- package/src/db/migrations/index.ts +3 -1
- package/src/db/types.ts +40 -0
- package/src/krl.ts +32 -194
- package/src/proof.ts +65 -31
- package/src/router.ts +3 -1
- package/src/ssh/certificate.ts +236 -0
- package/src/ssh/encoding.ts +81 -0
- package/src/ssh/keys.ts +294 -0
- package/src/ssh/signer.ts +129 -0
- package/src/types.ts +12 -18
- package/src/utils.ts +99 -69
package/openapi.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"openapi": "3.1.0",
|
|
3
3
|
"info": {
|
|
4
4
|
"title": "Serverless SSH CA API",
|
|
5
|
-
"version": "
|
|
5
|
+
"version": "4.0.0"
|
|
6
6
|
},
|
|
7
7
|
"components": {
|
|
8
8
|
"securitySchemes": {
|
|
@@ -90,6 +90,45 @@
|
|
|
90
90
|
"signature"
|
|
91
91
|
]
|
|
92
92
|
},
|
|
93
|
+
"Revocation Response": {
|
|
94
|
+
"type": "object",
|
|
95
|
+
"properties": {
|
|
96
|
+
"revoked_at": {
|
|
97
|
+
"type": "string",
|
|
98
|
+
"format": "date-time"
|
|
99
|
+
}
|
|
100
|
+
},
|
|
101
|
+
"required": [
|
|
102
|
+
"revoked_at"
|
|
103
|
+
]
|
|
104
|
+
},
|
|
105
|
+
"Certificate Revocation": {
|
|
106
|
+
"type": "object",
|
|
107
|
+
"properties": {
|
|
108
|
+
"serial": {
|
|
109
|
+
"type": "string",
|
|
110
|
+
"pattern": "^\\d+$",
|
|
111
|
+
"description": "Serial number of certificate to revoke",
|
|
112
|
+
"example": "12345678901234567890"
|
|
113
|
+
},
|
|
114
|
+
"public_key": {
|
|
115
|
+
"type": "string",
|
|
116
|
+
"format": "byte",
|
|
117
|
+
"description": "SSH public key to sign",
|
|
118
|
+
"example": "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
|
|
119
|
+
},
|
|
120
|
+
"proof": {
|
|
121
|
+
"type": "string",
|
|
122
|
+
"description": "Proof of possession comprising of ${timestamp}.${fingerprint}.${signature}",
|
|
123
|
+
"example": "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0KVTFOSVUwbEhBQUFBQVFBQUFHZ0FBQUFUWldOa2MyRXRjMmhoTWkxdWFYTjBjREkxTmdBQUFBaHVhWE4wY0RJMQpOZ0FBQUVFRUR6Ymk4OE10alBYSDFCb1JURU9HaS96aEc4QnhQNVZUUW5OQkFNMGZtMExtekErUUZkUlNVYVRFCkdNN2l0QjhINmZNZFAydlAxcElQcGUyOWVLQkJZd0FBQUFSbWFXeGxBQUFBQUFBQUFBWnphR0UxTVRJQUFBQmsKQUFBQUUyVmpaSE5oTFhOb1lUSXRibWx6ZEhBeU5UWUFBQUJKQUFBQUlHdmZVZGNDQkRXa3ZwL0ZHS3NkakgrRQpKZzZXN0EvWUJVZng2Z0srQ01raEFBQUFJUUQxOFd5cDNZejZ0eXNvdllXbEJHTXprRnlYbFRrSHM5blVVRXJqCkczNWVPQT09Ci0tLS0tRU5EIFNTSCBTSUdOQVRVUkUtLS0tLQo="
|
|
124
|
+
}
|
|
125
|
+
},
|
|
126
|
+
"required": [
|
|
127
|
+
"serial",
|
|
128
|
+
"public_key",
|
|
129
|
+
"proof"
|
|
130
|
+
]
|
|
131
|
+
},
|
|
93
132
|
"Host Certificate Request": {
|
|
94
133
|
"type": "object",
|
|
95
134
|
"properties": {
|
|
@@ -165,43 +204,101 @@
|
|
|
165
204
|
"proof"
|
|
166
205
|
]
|
|
167
206
|
},
|
|
168
|
-
"
|
|
207
|
+
"User Certificate Issue Request": {
|
|
169
208
|
"type": "object",
|
|
170
209
|
"properties": {
|
|
171
|
-
"
|
|
210
|
+
"public_key": {
|
|
172
211
|
"type": "string",
|
|
173
|
-
"format": "
|
|
212
|
+
"format": "byte",
|
|
213
|
+
"description": "SSH public key to sign",
|
|
214
|
+
"example": "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
|
|
215
|
+
},
|
|
216
|
+
"identity": {
|
|
217
|
+
"type": "string",
|
|
218
|
+
"description": "Identity Token JWT from OIDC IdP",
|
|
219
|
+
"example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
|
|
220
|
+
},
|
|
221
|
+
"extensions": {
|
|
222
|
+
"type": "array",
|
|
223
|
+
"items": {
|
|
224
|
+
"type": "string"
|
|
225
|
+
},
|
|
226
|
+
"default": [
|
|
227
|
+
"permit-X11-forwarding",
|
|
228
|
+
"permit-agent-forwarding",
|
|
229
|
+
"permit-port-forwarding",
|
|
230
|
+
"permit-pty",
|
|
231
|
+
"permit-user-rc"
|
|
232
|
+
],
|
|
233
|
+
"description": "Extensions to include in the issued SSH certificate"
|
|
234
|
+
},
|
|
235
|
+
"lifetime": {
|
|
236
|
+
"type": "integer",
|
|
237
|
+
"minimum": 300,
|
|
238
|
+
"maximum": 86400,
|
|
239
|
+
"default": 86400,
|
|
240
|
+
"description": "Lifetime of issued SSH certificate"
|
|
174
241
|
}
|
|
175
242
|
},
|
|
176
243
|
"required": [
|
|
177
|
-
"
|
|
244
|
+
"public_key",
|
|
245
|
+
"identity"
|
|
178
246
|
]
|
|
179
247
|
},
|
|
180
|
-
"Certificate
|
|
248
|
+
"Host Certificate Issue Request": {
|
|
181
249
|
"type": "object",
|
|
182
250
|
"properties": {
|
|
183
|
-
"serial": {
|
|
184
|
-
"type": "string",
|
|
185
|
-
"pattern": "^\\d+$",
|
|
186
|
-
"description": "Serial number of certificate to revoke",
|
|
187
|
-
"example": "12345678901234567890"
|
|
188
|
-
},
|
|
189
251
|
"public_key": {
|
|
190
252
|
"type": "string",
|
|
191
253
|
"format": "byte",
|
|
192
254
|
"description": "SSH public key to sign",
|
|
193
255
|
"example": "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
|
|
194
256
|
},
|
|
195
|
-
"
|
|
257
|
+
"identity": {
|
|
196
258
|
"type": "string",
|
|
197
|
-
"description": "
|
|
198
|
-
"example": "
|
|
259
|
+
"description": "Identity Token JWT from OIDC IdP",
|
|
260
|
+
"example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
|
|
261
|
+
},
|
|
262
|
+
"principals": {
|
|
263
|
+
"type": "array",
|
|
264
|
+
"items": {
|
|
265
|
+
"type": "string"
|
|
266
|
+
},
|
|
267
|
+
"minItems": 1,
|
|
268
|
+
"description": "List of principals to include on the issued certificate"
|
|
269
|
+
},
|
|
270
|
+
"lifetime": {
|
|
271
|
+
"type": "integer",
|
|
272
|
+
"minimum": 86400,
|
|
273
|
+
"maximum": 2592000,
|
|
274
|
+
"default": 2592000,
|
|
275
|
+
"description": "Lifetime of issued Host SSH certificate"
|
|
199
276
|
}
|
|
200
277
|
},
|
|
201
278
|
"required": [
|
|
202
|
-
"serial",
|
|
203
279
|
"public_key",
|
|
204
|
-
"
|
|
280
|
+
"identity",
|
|
281
|
+
"principals"
|
|
282
|
+
]
|
|
283
|
+
},
|
|
284
|
+
"Host Certificate Renewal Request": {
|
|
285
|
+
"type": "object",
|
|
286
|
+
"properties": {
|
|
287
|
+
"certificate": {
|
|
288
|
+
"type": "string",
|
|
289
|
+
"format": "byte",
|
|
290
|
+
"description": "SSH certificate to renew, which must have the serial number in the path"
|
|
291
|
+
},
|
|
292
|
+
"lifetime": {
|
|
293
|
+
"type": "integer",
|
|
294
|
+
"minimum": 86400,
|
|
295
|
+
"maximum": 2592000,
|
|
296
|
+
"default": 2592000,
|
|
297
|
+
"description": "Lifetime of renewed Host SSH certificate"
|
|
298
|
+
}
|
|
299
|
+
},
|
|
300
|
+
"required": [
|
|
301
|
+
"certificate"
|
|
205
302
|
]
|
|
206
303
|
}
|
|
207
304
|
},
|
|
@@ -210,6 +307,11 @@
|
|
|
210
307
|
"paths": {
|
|
211
308
|
"/api/v3/ca": {
|
|
212
309
|
"get": {
|
|
310
|
+
"tags": [
|
|
311
|
+
"CA"
|
|
312
|
+
],
|
|
313
|
+
"summary": "Get the CA public key",
|
|
314
|
+
"description": "Returns the public key of the SSH Certificate Authority in OpenSSH format, for use in `TrustedUserCAKeys` on SSH servers or `@cert-authority` entries in `known_hosts` on SSH clients.",
|
|
213
315
|
"operationId": "get_ca",
|
|
214
316
|
"responses": {
|
|
215
317
|
"200": {
|
|
@@ -267,6 +369,11 @@
|
|
|
267
369
|
},
|
|
268
370
|
"/api/v3/user/certificate": {
|
|
269
371
|
"post": {
|
|
372
|
+
"tags": [
|
|
373
|
+
"User"
|
|
374
|
+
],
|
|
375
|
+
"summary": "Request a user certificate",
|
|
376
|
+
"description": "Issues a signed SSH user certificate for the provided public key. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key. Principals on the issued certificate are derived from the identity token.",
|
|
270
377
|
"security": [
|
|
271
378
|
{
|
|
272
379
|
"oidcAuth": []
|
|
@@ -523,26 +630,17 @@
|
|
|
523
630
|
}
|
|
524
631
|
}
|
|
525
632
|
},
|
|
526
|
-
"/api/v3/
|
|
633
|
+
"/api/v3/user/krl": {
|
|
527
634
|
"get": {
|
|
528
|
-
"
|
|
529
|
-
|
|
530
|
-
{
|
|
531
|
-
"schema": {
|
|
532
|
-
"type": "string",
|
|
533
|
-
"enum": [
|
|
534
|
-
"user",
|
|
535
|
-
"host"
|
|
536
|
-
]
|
|
537
|
-
},
|
|
538
|
-
"required": true,
|
|
539
|
-
"name": "certificateType",
|
|
540
|
-
"in": "path"
|
|
541
|
-
}
|
|
635
|
+
"tags": [
|
|
636
|
+
"User"
|
|
542
637
|
],
|
|
638
|
+
"summary": "Get the Key Revocation List for user certificates",
|
|
639
|
+
"description": "Returns the OpenSSH Key Revocation List (KRL) of revoked user certificates issued by this CA, along with an SSHSIG signature made by the CA key so the KRL can be verified before use.",
|
|
640
|
+
"operationId": "get_user_krl",
|
|
543
641
|
"responses": {
|
|
544
642
|
"200": {
|
|
545
|
-
"description": "Returns an Open SSH Key Revocation List as BASE64 and an SSHSIG signature for verification",
|
|
643
|
+
"description": "Returns an Open SSH Key Revocation List of revoked user certificates as BASE64 and an SSHSIG signature for verification",
|
|
546
644
|
"content": {
|
|
547
645
|
"application/json": {
|
|
548
646
|
"schema": {
|
|
@@ -594,43 +692,30 @@
|
|
|
594
692
|
}
|
|
595
693
|
}
|
|
596
694
|
},
|
|
597
|
-
"/api/v3/
|
|
695
|
+
"/api/v3/user/revoke": {
|
|
598
696
|
"post": {
|
|
599
|
-
"
|
|
600
|
-
|
|
601
|
-
"oidcAuth": []
|
|
602
|
-
}
|
|
603
|
-
],
|
|
604
|
-
"operationId": "post_host_certificate",
|
|
605
|
-
"parameters": [
|
|
606
|
-
{
|
|
607
|
-
"schema": {
|
|
608
|
-
"type": "string",
|
|
609
|
-
"description": "Access Token JWT from OIDC IdP",
|
|
610
|
-
"example": "Bearer eyJ..."
|
|
611
|
-
},
|
|
612
|
-
"required": true,
|
|
613
|
-
"description": "Access Token JWT from OIDC IdP",
|
|
614
|
-
"name": "Authorization",
|
|
615
|
-
"in": "header"
|
|
616
|
-
}
|
|
697
|
+
"tags": [
|
|
698
|
+
"User"
|
|
617
699
|
],
|
|
700
|
+
"summary": "Revoke a user certificate",
|
|
701
|
+
"description": "Revokes a user certificate issued by this CA, identified by its serial number, and adds it to the user Key Revocation List. The request must include a proof of possession of the private key for the public key that the certificate was issued for.",
|
|
702
|
+
"operationId": "post_user_revoke",
|
|
618
703
|
"requestBody": {
|
|
619
704
|
"content": {
|
|
620
705
|
"application/json": {
|
|
621
706
|
"schema": {
|
|
622
|
-
"$ref": "#/components/schemas/
|
|
707
|
+
"$ref": "#/components/schemas/Certificate Revocation"
|
|
623
708
|
}
|
|
624
709
|
}
|
|
625
710
|
}
|
|
626
711
|
},
|
|
627
712
|
"responses": {
|
|
628
713
|
"200": {
|
|
629
|
-
"description": "SSH
|
|
714
|
+
"description": "SSH user certificate revoked successfully",
|
|
630
715
|
"content": {
|
|
631
716
|
"application/json": {
|
|
632
717
|
"schema": {
|
|
633
|
-
"$ref": "#/components/schemas/
|
|
718
|
+
"$ref": "#/components/schemas/Revocation Response"
|
|
634
719
|
}
|
|
635
720
|
}
|
|
636
721
|
}
|
|
@@ -762,6 +847,46 @@
|
|
|
762
847
|
}
|
|
763
848
|
}
|
|
764
849
|
},
|
|
850
|
+
"409": {
|
|
851
|
+
"description": "Conflict",
|
|
852
|
+
"content": {
|
|
853
|
+
"application/json": {
|
|
854
|
+
"schema": {
|
|
855
|
+
"type": "object",
|
|
856
|
+
"properties": {
|
|
857
|
+
"success": {
|
|
858
|
+
"type": "boolean",
|
|
859
|
+
"enum": [
|
|
860
|
+
false
|
|
861
|
+
]
|
|
862
|
+
},
|
|
863
|
+
"errors": {
|
|
864
|
+
"type": "array",
|
|
865
|
+
"items": {
|
|
866
|
+
"type": "object",
|
|
867
|
+
"properties": {
|
|
868
|
+
"code": {
|
|
869
|
+
"type": "number"
|
|
870
|
+
},
|
|
871
|
+
"message": {
|
|
872
|
+
"type": "string"
|
|
873
|
+
}
|
|
874
|
+
},
|
|
875
|
+
"required": [
|
|
876
|
+
"code",
|
|
877
|
+
"message"
|
|
878
|
+
]
|
|
879
|
+
}
|
|
880
|
+
}
|
|
881
|
+
},
|
|
882
|
+
"required": [
|
|
883
|
+
"success",
|
|
884
|
+
"errors"
|
|
885
|
+
]
|
|
886
|
+
}
|
|
887
|
+
}
|
|
888
|
+
}
|
|
889
|
+
},
|
|
765
890
|
"422": {
|
|
766
891
|
"description": "Unprocessable Entity",
|
|
767
892
|
"content": {
|
|
@@ -852,21 +977,44 @@
|
|
|
852
977
|
}
|
|
853
978
|
}
|
|
854
979
|
},
|
|
855
|
-
"/api/v3/host/
|
|
980
|
+
"/api/v3/host/certificate": {
|
|
856
981
|
"post": {
|
|
857
|
-
"
|
|
982
|
+
"tags": [
|
|
983
|
+
"Host"
|
|
984
|
+
],
|
|
985
|
+
"summary": "Request a host certificate",
|
|
986
|
+
"description": "Issues a signed SSH host certificate for the provided public key and principals. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key. The user must be permitted to request host certificates by email address or role.",
|
|
987
|
+
"security": [
|
|
988
|
+
{
|
|
989
|
+
"oidcAuth": []
|
|
990
|
+
}
|
|
991
|
+
],
|
|
992
|
+
"operationId": "post_host_certificate",
|
|
993
|
+
"parameters": [
|
|
994
|
+
{
|
|
995
|
+
"schema": {
|
|
996
|
+
"type": "string",
|
|
997
|
+
"description": "Access Token JWT from OIDC IdP",
|
|
998
|
+
"example": "Bearer eyJ..."
|
|
999
|
+
},
|
|
1000
|
+
"required": true,
|
|
1001
|
+
"description": "Access Token JWT from OIDC IdP",
|
|
1002
|
+
"name": "Authorization",
|
|
1003
|
+
"in": "header"
|
|
1004
|
+
}
|
|
1005
|
+
],
|
|
858
1006
|
"requestBody": {
|
|
859
1007
|
"content": {
|
|
860
1008
|
"application/json": {
|
|
861
1009
|
"schema": {
|
|
862
|
-
"$ref": "#/components/schemas/Host Certificate
|
|
1010
|
+
"$ref": "#/components/schemas/Host Certificate Request"
|
|
863
1011
|
}
|
|
864
1012
|
}
|
|
865
1013
|
}
|
|
866
1014
|
},
|
|
867
1015
|
"responses": {
|
|
868
1016
|
"200": {
|
|
869
|
-
"description": "SSH Host Certificate
|
|
1017
|
+
"description": "SSH Host Certificate issued successfully",
|
|
870
1018
|
"content": {
|
|
871
1019
|
"application/json": {
|
|
872
1020
|
"schema": {
|
|
@@ -1092,39 +1240,30 @@
|
|
|
1092
1240
|
}
|
|
1093
1241
|
}
|
|
1094
1242
|
},
|
|
1095
|
-
"/api/v3/
|
|
1243
|
+
"/api/v3/host/renew": {
|
|
1096
1244
|
"post": {
|
|
1097
|
-
"
|
|
1098
|
-
|
|
1099
|
-
{
|
|
1100
|
-
"schema": {
|
|
1101
|
-
"type": "string",
|
|
1102
|
-
"enum": [
|
|
1103
|
-
"user",
|
|
1104
|
-
"host"
|
|
1105
|
-
]
|
|
1106
|
-
},
|
|
1107
|
-
"required": true,
|
|
1108
|
-
"name": "certificateType",
|
|
1109
|
-
"in": "path"
|
|
1110
|
-
}
|
|
1245
|
+
"tags": [
|
|
1246
|
+
"Host"
|
|
1111
1247
|
],
|
|
1248
|
+
"summary": "Renew a host certificate",
|
|
1249
|
+
"description": "Issues a new SSH host certificate with the same principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the public key must match the existing certificate and the proof of possession must be made with its private key. The lifetime of the renewed certificate is no longer than that of the existing certificate.",
|
|
1250
|
+
"operationId": "post_host_renew",
|
|
1112
1251
|
"requestBody": {
|
|
1113
1252
|
"content": {
|
|
1114
1253
|
"application/json": {
|
|
1115
1254
|
"schema": {
|
|
1116
|
-
"$ref": "#/components/schemas/Certificate
|
|
1255
|
+
"$ref": "#/components/schemas/Host Certificate Renew"
|
|
1117
1256
|
}
|
|
1118
1257
|
}
|
|
1119
1258
|
}
|
|
1120
1259
|
},
|
|
1121
1260
|
"responses": {
|
|
1122
1261
|
"200": {
|
|
1123
|
-
"description": "SSH
|
|
1262
|
+
"description": "SSH Host Certificate renewed successfully",
|
|
1124
1263
|
"content": {
|
|
1125
1264
|
"application/json": {
|
|
1126
1265
|
"schema": {
|
|
1127
|
-
"$ref": "#/components/schemas/
|
|
1266
|
+
"$ref": "#/components/schemas/Certificate Response"
|
|
1128
1267
|
}
|
|
1129
1268
|
}
|
|
1130
1269
|
}
|
|
@@ -1256,8 +1395,8 @@
|
|
|
1256
1395
|
}
|
|
1257
1396
|
}
|
|
1258
1397
|
},
|
|
1259
|
-
"
|
|
1260
|
-
"description": "
|
|
1398
|
+
"422": {
|
|
1399
|
+
"description": "Unprocessable Entity",
|
|
1261
1400
|
"content": {
|
|
1262
1401
|
"application/json": {
|
|
1263
1402
|
"schema": {
|
|
@@ -1279,11 +1418,18 @@
|
|
|
1279
1418
|
},
|
|
1280
1419
|
"message": {
|
|
1281
1420
|
"type": "string"
|
|
1421
|
+
},
|
|
1422
|
+
"path": {
|
|
1423
|
+
"type": "array",
|
|
1424
|
+
"items": {
|
|
1425
|
+
"type": "string"
|
|
1426
|
+
}
|
|
1282
1427
|
}
|
|
1283
1428
|
},
|
|
1284
1429
|
"required": [
|
|
1285
1430
|
"code",
|
|
1286
|
-
"message"
|
|
1431
|
+
"message",
|
|
1432
|
+
"path"
|
|
1287
1433
|
]
|
|
1288
1434
|
}
|
|
1289
1435
|
}
|
|
@@ -1296,8 +1442,1598 @@
|
|
|
1296
1442
|
}
|
|
1297
1443
|
}
|
|
1298
1444
|
},
|
|
1299
|
-
"
|
|
1300
|
-
"description": "
|
|
1445
|
+
"500": {
|
|
1446
|
+
"description": "Internal Server Error",
|
|
1447
|
+
"content": {
|
|
1448
|
+
"application/json": {
|
|
1449
|
+
"schema": {
|
|
1450
|
+
"type": "object",
|
|
1451
|
+
"properties": {
|
|
1452
|
+
"success": {
|
|
1453
|
+
"type": "boolean",
|
|
1454
|
+
"enum": [
|
|
1455
|
+
false
|
|
1456
|
+
]
|
|
1457
|
+
},
|
|
1458
|
+
"errors": {
|
|
1459
|
+
"type": "array",
|
|
1460
|
+
"items": {
|
|
1461
|
+
"type": "object",
|
|
1462
|
+
"properties": {
|
|
1463
|
+
"code": {
|
|
1464
|
+
"type": "number"
|
|
1465
|
+
},
|
|
1466
|
+
"message": {
|
|
1467
|
+
"type": "string"
|
|
1468
|
+
}
|
|
1469
|
+
},
|
|
1470
|
+
"required": [
|
|
1471
|
+
"code",
|
|
1472
|
+
"message"
|
|
1473
|
+
]
|
|
1474
|
+
}
|
|
1475
|
+
}
|
|
1476
|
+
},
|
|
1477
|
+
"required": [
|
|
1478
|
+
"success",
|
|
1479
|
+
"errors"
|
|
1480
|
+
]
|
|
1481
|
+
}
|
|
1482
|
+
}
|
|
1483
|
+
}
|
|
1484
|
+
}
|
|
1485
|
+
}
|
|
1486
|
+
}
|
|
1487
|
+
},
|
|
1488
|
+
"/api/v3/host/krl": {
|
|
1489
|
+
"get": {
|
|
1490
|
+
"tags": [
|
|
1491
|
+
"Host"
|
|
1492
|
+
],
|
|
1493
|
+
"summary": "Get the Key Revocation List for host certificates",
|
|
1494
|
+
"description": "Returns the OpenSSH Key Revocation List (KRL) of revoked host certificates issued by this CA, along with an SSHSIG signature made by the CA key so the KRL can be verified before use.",
|
|
1495
|
+
"operationId": "get_host_krl",
|
|
1496
|
+
"responses": {
|
|
1497
|
+
"200": {
|
|
1498
|
+
"description": "Returns an Open SSH Key Revocation List of revoked host certificates as BASE64 and an SSHSIG signature for verification",
|
|
1499
|
+
"content": {
|
|
1500
|
+
"application/json": {
|
|
1501
|
+
"schema": {
|
|
1502
|
+
"$ref": "#/components/schemas/Key Revocation List Response"
|
|
1503
|
+
}
|
|
1504
|
+
}
|
|
1505
|
+
}
|
|
1506
|
+
},
|
|
1507
|
+
"500": {
|
|
1508
|
+
"description": "Internal Server Error",
|
|
1509
|
+
"content": {
|
|
1510
|
+
"application/json": {
|
|
1511
|
+
"schema": {
|
|
1512
|
+
"type": "object",
|
|
1513
|
+
"properties": {
|
|
1514
|
+
"success": {
|
|
1515
|
+
"type": "boolean",
|
|
1516
|
+
"enum": [
|
|
1517
|
+
false
|
|
1518
|
+
]
|
|
1519
|
+
},
|
|
1520
|
+
"errors": {
|
|
1521
|
+
"type": "array",
|
|
1522
|
+
"items": {
|
|
1523
|
+
"type": "object",
|
|
1524
|
+
"properties": {
|
|
1525
|
+
"code": {
|
|
1526
|
+
"type": "number"
|
|
1527
|
+
},
|
|
1528
|
+
"message": {
|
|
1529
|
+
"type": "string"
|
|
1530
|
+
}
|
|
1531
|
+
},
|
|
1532
|
+
"required": [
|
|
1533
|
+
"code",
|
|
1534
|
+
"message"
|
|
1535
|
+
]
|
|
1536
|
+
}
|
|
1537
|
+
}
|
|
1538
|
+
},
|
|
1539
|
+
"required": [
|
|
1540
|
+
"success",
|
|
1541
|
+
"errors"
|
|
1542
|
+
]
|
|
1543
|
+
}
|
|
1544
|
+
}
|
|
1545
|
+
}
|
|
1546
|
+
}
|
|
1547
|
+
}
|
|
1548
|
+
}
|
|
1549
|
+
},
|
|
1550
|
+
"/api/v3/host/revoke": {
|
|
1551
|
+
"post": {
|
|
1552
|
+
"tags": [
|
|
1553
|
+
"Host"
|
|
1554
|
+
],
|
|
1555
|
+
"summary": "Revoke a host certificate",
|
|
1556
|
+
"description": "Revokes a host certificate issued by this CA, identified by its serial number, and adds it to the host Key Revocation List. The request must include a proof of possession of the private key for the public key that the certificate was issued for.",
|
|
1557
|
+
"operationId": "post_host_revoke",
|
|
1558
|
+
"requestBody": {
|
|
1559
|
+
"content": {
|
|
1560
|
+
"application/json": {
|
|
1561
|
+
"schema": {
|
|
1562
|
+
"$ref": "#/components/schemas/Certificate Revocation"
|
|
1563
|
+
}
|
|
1564
|
+
}
|
|
1565
|
+
}
|
|
1566
|
+
},
|
|
1567
|
+
"responses": {
|
|
1568
|
+
"200": {
|
|
1569
|
+
"description": "SSH host certificate revoked successfully",
|
|
1570
|
+
"content": {
|
|
1571
|
+
"application/json": {
|
|
1572
|
+
"schema": {
|
|
1573
|
+
"$ref": "#/components/schemas/Revocation Response"
|
|
1574
|
+
}
|
|
1575
|
+
}
|
|
1576
|
+
}
|
|
1577
|
+
},
|
|
1578
|
+
"400": {
|
|
1579
|
+
"description": "Input Validation Error",
|
|
1580
|
+
"content": {
|
|
1581
|
+
"application/json": {
|
|
1582
|
+
"schema": {
|
|
1583
|
+
"type": "object",
|
|
1584
|
+
"properties": {
|
|
1585
|
+
"success": {
|
|
1586
|
+
"type": "boolean",
|
|
1587
|
+
"enum": [
|
|
1588
|
+
false
|
|
1589
|
+
]
|
|
1590
|
+
},
|
|
1591
|
+
"errors": {
|
|
1592
|
+
"type": "array",
|
|
1593
|
+
"items": {
|
|
1594
|
+
"type": "object",
|
|
1595
|
+
"properties": {
|
|
1596
|
+
"code": {
|
|
1597
|
+
"type": "number"
|
|
1598
|
+
},
|
|
1599
|
+
"message": {
|
|
1600
|
+
"type": "string"
|
|
1601
|
+
},
|
|
1602
|
+
"path": {
|
|
1603
|
+
"type": "array",
|
|
1604
|
+
"items": {
|
|
1605
|
+
"type": "string"
|
|
1606
|
+
}
|
|
1607
|
+
}
|
|
1608
|
+
},
|
|
1609
|
+
"required": [
|
|
1610
|
+
"code",
|
|
1611
|
+
"message",
|
|
1612
|
+
"path"
|
|
1613
|
+
]
|
|
1614
|
+
}
|
|
1615
|
+
}
|
|
1616
|
+
},
|
|
1617
|
+
"required": [
|
|
1618
|
+
"success",
|
|
1619
|
+
"errors"
|
|
1620
|
+
]
|
|
1621
|
+
}
|
|
1622
|
+
}
|
|
1623
|
+
}
|
|
1624
|
+
},
|
|
1625
|
+
"401": {
|
|
1626
|
+
"description": "Unauthorized",
|
|
1627
|
+
"content": {
|
|
1628
|
+
"application/json": {
|
|
1629
|
+
"schema": {
|
|
1630
|
+
"type": "object",
|
|
1631
|
+
"properties": {
|
|
1632
|
+
"success": {
|
|
1633
|
+
"type": "boolean",
|
|
1634
|
+
"enum": [
|
|
1635
|
+
false
|
|
1636
|
+
]
|
|
1637
|
+
},
|
|
1638
|
+
"errors": {
|
|
1639
|
+
"type": "array",
|
|
1640
|
+
"items": {
|
|
1641
|
+
"type": "object",
|
|
1642
|
+
"properties": {
|
|
1643
|
+
"code": {
|
|
1644
|
+
"type": "number"
|
|
1645
|
+
},
|
|
1646
|
+
"message": {
|
|
1647
|
+
"type": "string"
|
|
1648
|
+
}
|
|
1649
|
+
},
|
|
1650
|
+
"required": [
|
|
1651
|
+
"code",
|
|
1652
|
+
"message"
|
|
1653
|
+
]
|
|
1654
|
+
}
|
|
1655
|
+
}
|
|
1656
|
+
},
|
|
1657
|
+
"required": [
|
|
1658
|
+
"success",
|
|
1659
|
+
"errors"
|
|
1660
|
+
]
|
|
1661
|
+
}
|
|
1662
|
+
}
|
|
1663
|
+
}
|
|
1664
|
+
},
|
|
1665
|
+
"403": {
|
|
1666
|
+
"description": "Forbidden",
|
|
1667
|
+
"content": {
|
|
1668
|
+
"application/json": {
|
|
1669
|
+
"schema": {
|
|
1670
|
+
"type": "object",
|
|
1671
|
+
"properties": {
|
|
1672
|
+
"success": {
|
|
1673
|
+
"type": "boolean",
|
|
1674
|
+
"enum": [
|
|
1675
|
+
false
|
|
1676
|
+
]
|
|
1677
|
+
},
|
|
1678
|
+
"errors": {
|
|
1679
|
+
"type": "array",
|
|
1680
|
+
"items": {
|
|
1681
|
+
"type": "object",
|
|
1682
|
+
"properties": {
|
|
1683
|
+
"code": {
|
|
1684
|
+
"type": "number"
|
|
1685
|
+
},
|
|
1686
|
+
"message": {
|
|
1687
|
+
"type": "string"
|
|
1688
|
+
}
|
|
1689
|
+
},
|
|
1690
|
+
"required": [
|
|
1691
|
+
"code",
|
|
1692
|
+
"message"
|
|
1693
|
+
]
|
|
1694
|
+
}
|
|
1695
|
+
}
|
|
1696
|
+
},
|
|
1697
|
+
"required": [
|
|
1698
|
+
"success",
|
|
1699
|
+
"errors"
|
|
1700
|
+
]
|
|
1701
|
+
}
|
|
1702
|
+
}
|
|
1703
|
+
}
|
|
1704
|
+
},
|
|
1705
|
+
"409": {
|
|
1706
|
+
"description": "Conflict",
|
|
1707
|
+
"content": {
|
|
1708
|
+
"application/json": {
|
|
1709
|
+
"schema": {
|
|
1710
|
+
"type": "object",
|
|
1711
|
+
"properties": {
|
|
1712
|
+
"success": {
|
|
1713
|
+
"type": "boolean",
|
|
1714
|
+
"enum": [
|
|
1715
|
+
false
|
|
1716
|
+
]
|
|
1717
|
+
},
|
|
1718
|
+
"errors": {
|
|
1719
|
+
"type": "array",
|
|
1720
|
+
"items": {
|
|
1721
|
+
"type": "object",
|
|
1722
|
+
"properties": {
|
|
1723
|
+
"code": {
|
|
1724
|
+
"type": "number"
|
|
1725
|
+
},
|
|
1726
|
+
"message": {
|
|
1727
|
+
"type": "string"
|
|
1728
|
+
}
|
|
1729
|
+
},
|
|
1730
|
+
"required": [
|
|
1731
|
+
"code",
|
|
1732
|
+
"message"
|
|
1733
|
+
]
|
|
1734
|
+
}
|
|
1735
|
+
}
|
|
1736
|
+
},
|
|
1737
|
+
"required": [
|
|
1738
|
+
"success",
|
|
1739
|
+
"errors"
|
|
1740
|
+
]
|
|
1741
|
+
}
|
|
1742
|
+
}
|
|
1743
|
+
}
|
|
1744
|
+
},
|
|
1745
|
+
"422": {
|
|
1746
|
+
"description": "Unprocessable Entity",
|
|
1747
|
+
"content": {
|
|
1748
|
+
"application/json": {
|
|
1749
|
+
"schema": {
|
|
1750
|
+
"type": "object",
|
|
1751
|
+
"properties": {
|
|
1752
|
+
"success": {
|
|
1753
|
+
"type": "boolean",
|
|
1754
|
+
"enum": [
|
|
1755
|
+
false
|
|
1756
|
+
]
|
|
1757
|
+
},
|
|
1758
|
+
"errors": {
|
|
1759
|
+
"type": "array",
|
|
1760
|
+
"items": {
|
|
1761
|
+
"type": "object",
|
|
1762
|
+
"properties": {
|
|
1763
|
+
"code": {
|
|
1764
|
+
"type": "number"
|
|
1765
|
+
},
|
|
1766
|
+
"message": {
|
|
1767
|
+
"type": "string"
|
|
1768
|
+
},
|
|
1769
|
+
"path": {
|
|
1770
|
+
"type": "array",
|
|
1771
|
+
"items": {
|
|
1772
|
+
"type": "string"
|
|
1773
|
+
}
|
|
1774
|
+
}
|
|
1775
|
+
},
|
|
1776
|
+
"required": [
|
|
1777
|
+
"code",
|
|
1778
|
+
"message",
|
|
1779
|
+
"path"
|
|
1780
|
+
]
|
|
1781
|
+
}
|
|
1782
|
+
}
|
|
1783
|
+
},
|
|
1784
|
+
"required": [
|
|
1785
|
+
"success",
|
|
1786
|
+
"errors"
|
|
1787
|
+
]
|
|
1788
|
+
}
|
|
1789
|
+
}
|
|
1790
|
+
}
|
|
1791
|
+
},
|
|
1792
|
+
"500": {
|
|
1793
|
+
"description": "Internal Server Error",
|
|
1794
|
+
"content": {
|
|
1795
|
+
"application/json": {
|
|
1796
|
+
"schema": {
|
|
1797
|
+
"type": "object",
|
|
1798
|
+
"properties": {
|
|
1799
|
+
"success": {
|
|
1800
|
+
"type": "boolean",
|
|
1801
|
+
"enum": [
|
|
1802
|
+
false
|
|
1803
|
+
]
|
|
1804
|
+
},
|
|
1805
|
+
"errors": {
|
|
1806
|
+
"type": "array",
|
|
1807
|
+
"items": {
|
|
1808
|
+
"type": "object",
|
|
1809
|
+
"properties": {
|
|
1810
|
+
"code": {
|
|
1811
|
+
"type": "number"
|
|
1812
|
+
},
|
|
1813
|
+
"message": {
|
|
1814
|
+
"type": "string"
|
|
1815
|
+
}
|
|
1816
|
+
},
|
|
1817
|
+
"required": [
|
|
1818
|
+
"code",
|
|
1819
|
+
"message"
|
|
1820
|
+
]
|
|
1821
|
+
}
|
|
1822
|
+
}
|
|
1823
|
+
},
|
|
1824
|
+
"required": [
|
|
1825
|
+
"success",
|
|
1826
|
+
"errors"
|
|
1827
|
+
]
|
|
1828
|
+
}
|
|
1829
|
+
}
|
|
1830
|
+
}
|
|
1831
|
+
}
|
|
1832
|
+
}
|
|
1833
|
+
}
|
|
1834
|
+
},
|
|
1835
|
+
"/api/v4/ca": {
|
|
1836
|
+
"get": {
|
|
1837
|
+
"tags": [
|
|
1838
|
+
"CA"
|
|
1839
|
+
],
|
|
1840
|
+
"summary": "Get the CA public key",
|
|
1841
|
+
"description": "Returns the public key of the SSH Certificate Authority in OpenSSH format, for use in `TrustedUserCAKeys` on SSH servers or `@cert-authority` entries in `known_hosts` on SSH clients.",
|
|
1842
|
+
"operationId": "get_ca_public_key",
|
|
1843
|
+
"responses": {
|
|
1844
|
+
"200": {
|
|
1845
|
+
"description": "Returns SSH Certificate Authority Public Key",
|
|
1846
|
+
"content": {
|
|
1847
|
+
"text/plain": {
|
|
1848
|
+
"schema": {
|
|
1849
|
+
"type": "string"
|
|
1850
|
+
}
|
|
1851
|
+
}
|
|
1852
|
+
}
|
|
1853
|
+
},
|
|
1854
|
+
"500": {
|
|
1855
|
+
"description": "Internal Server Error",
|
|
1856
|
+
"content": {
|
|
1857
|
+
"application/json": {
|
|
1858
|
+
"schema": {
|
|
1859
|
+
"type": "object",
|
|
1860
|
+
"properties": {
|
|
1861
|
+
"success": {
|
|
1862
|
+
"type": "boolean",
|
|
1863
|
+
"enum": [
|
|
1864
|
+
false
|
|
1865
|
+
]
|
|
1866
|
+
},
|
|
1867
|
+
"errors": {
|
|
1868
|
+
"type": "array",
|
|
1869
|
+
"items": {
|
|
1870
|
+
"type": "object",
|
|
1871
|
+
"properties": {
|
|
1872
|
+
"code": {
|
|
1873
|
+
"type": "number"
|
|
1874
|
+
},
|
|
1875
|
+
"message": {
|
|
1876
|
+
"type": "string"
|
|
1877
|
+
}
|
|
1878
|
+
},
|
|
1879
|
+
"required": [
|
|
1880
|
+
"code",
|
|
1881
|
+
"message"
|
|
1882
|
+
]
|
|
1883
|
+
}
|
|
1884
|
+
}
|
|
1885
|
+
},
|
|
1886
|
+
"required": [
|
|
1887
|
+
"success",
|
|
1888
|
+
"errors"
|
|
1889
|
+
]
|
|
1890
|
+
}
|
|
1891
|
+
}
|
|
1892
|
+
}
|
|
1893
|
+
}
|
|
1894
|
+
}
|
|
1895
|
+
}
|
|
1896
|
+
},
|
|
1897
|
+
"/api/v4/user/certificates": {
|
|
1898
|
+
"post": {
|
|
1899
|
+
"tags": [
|
|
1900
|
+
"User"
|
|
1901
|
+
],
|
|
1902
|
+
"operationId": "issue_user_certificate",
|
|
1903
|
+
"summary": "Request a user certificate",
|
|
1904
|
+
"description": "Issues a signed SSH user certificate for the provided public key. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key for `public_key` in the `Proof-Of-Possession` header made for this request. Principals on the issued certificate are derived from the identity token.",
|
|
1905
|
+
"security": [
|
|
1906
|
+
{
|
|
1907
|
+
"oidcAuth": []
|
|
1908
|
+
}
|
|
1909
|
+
],
|
|
1910
|
+
"parameters": [
|
|
1911
|
+
{
|
|
1912
|
+
"schema": {
|
|
1913
|
+
"type": "string",
|
|
1914
|
+
"description": "Access Token JWT from OIDC IdP",
|
|
1915
|
+
"example": "Bearer eyJ..."
|
|
1916
|
+
},
|
|
1917
|
+
"required": true,
|
|
1918
|
+
"description": "Access Token JWT from OIDC IdP",
|
|
1919
|
+
"name": "Authorization",
|
|
1920
|
+
"in": "header"
|
|
1921
|
+
},
|
|
1922
|
+
{
|
|
1923
|
+
"schema": {
|
|
1924
|
+
"type": "string",
|
|
1925
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
1926
|
+
"example": "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K..."
|
|
1927
|
+
},
|
|
1928
|
+
"required": true,
|
|
1929
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
1930
|
+
"name": "Proof-Of-Possession",
|
|
1931
|
+
"in": "header"
|
|
1932
|
+
}
|
|
1933
|
+
],
|
|
1934
|
+
"requestBody": {
|
|
1935
|
+
"content": {
|
|
1936
|
+
"application/json": {
|
|
1937
|
+
"schema": {
|
|
1938
|
+
"$ref": "#/components/schemas/User Certificate Issue Request"
|
|
1939
|
+
}
|
|
1940
|
+
}
|
|
1941
|
+
}
|
|
1942
|
+
},
|
|
1943
|
+
"responses": {
|
|
1944
|
+
"200": {
|
|
1945
|
+
"description": "SSH User Certificate issued successfully",
|
|
1946
|
+
"content": {
|
|
1947
|
+
"application/json": {
|
|
1948
|
+
"schema": {
|
|
1949
|
+
"$ref": "#/components/schemas/Certificate Response"
|
|
1950
|
+
}
|
|
1951
|
+
}
|
|
1952
|
+
}
|
|
1953
|
+
},
|
|
1954
|
+
"400": {
|
|
1955
|
+
"description": "Input Validation Error",
|
|
1956
|
+
"content": {
|
|
1957
|
+
"application/json": {
|
|
1958
|
+
"schema": {
|
|
1959
|
+
"type": "object",
|
|
1960
|
+
"properties": {
|
|
1961
|
+
"success": {
|
|
1962
|
+
"type": "boolean",
|
|
1963
|
+
"enum": [
|
|
1964
|
+
false
|
|
1965
|
+
]
|
|
1966
|
+
},
|
|
1967
|
+
"errors": {
|
|
1968
|
+
"type": "array",
|
|
1969
|
+
"items": {
|
|
1970
|
+
"type": "object",
|
|
1971
|
+
"properties": {
|
|
1972
|
+
"code": {
|
|
1973
|
+
"type": "number"
|
|
1974
|
+
},
|
|
1975
|
+
"message": {
|
|
1976
|
+
"type": "string"
|
|
1977
|
+
},
|
|
1978
|
+
"path": {
|
|
1979
|
+
"type": "array",
|
|
1980
|
+
"items": {
|
|
1981
|
+
"type": "string"
|
|
1982
|
+
}
|
|
1983
|
+
}
|
|
1984
|
+
},
|
|
1985
|
+
"required": [
|
|
1986
|
+
"code",
|
|
1987
|
+
"message",
|
|
1988
|
+
"path"
|
|
1989
|
+
]
|
|
1990
|
+
}
|
|
1991
|
+
}
|
|
1992
|
+
},
|
|
1993
|
+
"required": [
|
|
1994
|
+
"success",
|
|
1995
|
+
"errors"
|
|
1996
|
+
]
|
|
1997
|
+
}
|
|
1998
|
+
}
|
|
1999
|
+
}
|
|
2000
|
+
},
|
|
2001
|
+
"401": {
|
|
2002
|
+
"description": "Unauthorized",
|
|
2003
|
+
"content": {
|
|
2004
|
+
"application/json": {
|
|
2005
|
+
"schema": {
|
|
2006
|
+
"type": "object",
|
|
2007
|
+
"properties": {
|
|
2008
|
+
"success": {
|
|
2009
|
+
"type": "boolean",
|
|
2010
|
+
"enum": [
|
|
2011
|
+
false
|
|
2012
|
+
]
|
|
2013
|
+
},
|
|
2014
|
+
"errors": {
|
|
2015
|
+
"type": "array",
|
|
2016
|
+
"items": {
|
|
2017
|
+
"type": "object",
|
|
2018
|
+
"properties": {
|
|
2019
|
+
"code": {
|
|
2020
|
+
"type": "number"
|
|
2021
|
+
},
|
|
2022
|
+
"message": {
|
|
2023
|
+
"type": "string"
|
|
2024
|
+
}
|
|
2025
|
+
},
|
|
2026
|
+
"required": [
|
|
2027
|
+
"code",
|
|
2028
|
+
"message"
|
|
2029
|
+
]
|
|
2030
|
+
}
|
|
2031
|
+
}
|
|
2032
|
+
},
|
|
2033
|
+
"required": [
|
|
2034
|
+
"success",
|
|
2035
|
+
"errors"
|
|
2036
|
+
]
|
|
2037
|
+
}
|
|
2038
|
+
}
|
|
2039
|
+
}
|
|
2040
|
+
},
|
|
2041
|
+
"403": {
|
|
2042
|
+
"description": "Forbidden",
|
|
2043
|
+
"content": {
|
|
2044
|
+
"application/json": {
|
|
2045
|
+
"schema": {
|
|
2046
|
+
"type": "object",
|
|
2047
|
+
"properties": {
|
|
2048
|
+
"success": {
|
|
2049
|
+
"type": "boolean",
|
|
2050
|
+
"enum": [
|
|
2051
|
+
false
|
|
2052
|
+
]
|
|
2053
|
+
},
|
|
2054
|
+
"errors": {
|
|
2055
|
+
"type": "array",
|
|
2056
|
+
"items": {
|
|
2057
|
+
"type": "object",
|
|
2058
|
+
"properties": {
|
|
2059
|
+
"code": {
|
|
2060
|
+
"type": "number"
|
|
2061
|
+
},
|
|
2062
|
+
"message": {
|
|
2063
|
+
"type": "string"
|
|
2064
|
+
}
|
|
2065
|
+
},
|
|
2066
|
+
"required": [
|
|
2067
|
+
"code",
|
|
2068
|
+
"message"
|
|
2069
|
+
]
|
|
2070
|
+
}
|
|
2071
|
+
}
|
|
2072
|
+
},
|
|
2073
|
+
"required": [
|
|
2074
|
+
"success",
|
|
2075
|
+
"errors"
|
|
2076
|
+
]
|
|
2077
|
+
}
|
|
2078
|
+
}
|
|
2079
|
+
}
|
|
2080
|
+
},
|
|
2081
|
+
"422": {
|
|
2082
|
+
"description": "Unprocessable Entity",
|
|
2083
|
+
"content": {
|
|
2084
|
+
"application/json": {
|
|
2085
|
+
"schema": {
|
|
2086
|
+
"type": "object",
|
|
2087
|
+
"properties": {
|
|
2088
|
+
"success": {
|
|
2089
|
+
"type": "boolean",
|
|
2090
|
+
"enum": [
|
|
2091
|
+
false
|
|
2092
|
+
]
|
|
2093
|
+
},
|
|
2094
|
+
"errors": {
|
|
2095
|
+
"type": "array",
|
|
2096
|
+
"items": {
|
|
2097
|
+
"type": "object",
|
|
2098
|
+
"properties": {
|
|
2099
|
+
"code": {
|
|
2100
|
+
"type": "number"
|
|
2101
|
+
},
|
|
2102
|
+
"message": {
|
|
2103
|
+
"type": "string"
|
|
2104
|
+
},
|
|
2105
|
+
"path": {
|
|
2106
|
+
"type": "array",
|
|
2107
|
+
"items": {
|
|
2108
|
+
"type": "string"
|
|
2109
|
+
}
|
|
2110
|
+
}
|
|
2111
|
+
},
|
|
2112
|
+
"required": [
|
|
2113
|
+
"code",
|
|
2114
|
+
"message",
|
|
2115
|
+
"path"
|
|
2116
|
+
]
|
|
2117
|
+
}
|
|
2118
|
+
}
|
|
2119
|
+
},
|
|
2120
|
+
"required": [
|
|
2121
|
+
"success",
|
|
2122
|
+
"errors"
|
|
2123
|
+
]
|
|
2124
|
+
}
|
|
2125
|
+
}
|
|
2126
|
+
}
|
|
2127
|
+
},
|
|
2128
|
+
"500": {
|
|
2129
|
+
"description": "Internal Server Error",
|
|
2130
|
+
"content": {
|
|
2131
|
+
"application/json": {
|
|
2132
|
+
"schema": {
|
|
2133
|
+
"type": "object",
|
|
2134
|
+
"properties": {
|
|
2135
|
+
"success": {
|
|
2136
|
+
"type": "boolean",
|
|
2137
|
+
"enum": [
|
|
2138
|
+
false
|
|
2139
|
+
]
|
|
2140
|
+
},
|
|
2141
|
+
"errors": {
|
|
2142
|
+
"type": "array",
|
|
2143
|
+
"items": {
|
|
2144
|
+
"type": "object",
|
|
2145
|
+
"properties": {
|
|
2146
|
+
"code": {
|
|
2147
|
+
"type": "number"
|
|
2148
|
+
},
|
|
2149
|
+
"message": {
|
|
2150
|
+
"type": "string"
|
|
2151
|
+
}
|
|
2152
|
+
},
|
|
2153
|
+
"required": [
|
|
2154
|
+
"code",
|
|
2155
|
+
"message"
|
|
2156
|
+
]
|
|
2157
|
+
}
|
|
2158
|
+
}
|
|
2159
|
+
},
|
|
2160
|
+
"required": [
|
|
2161
|
+
"success",
|
|
2162
|
+
"errors"
|
|
2163
|
+
]
|
|
2164
|
+
}
|
|
2165
|
+
}
|
|
2166
|
+
}
|
|
2167
|
+
}
|
|
2168
|
+
}
|
|
2169
|
+
}
|
|
2170
|
+
},
|
|
2171
|
+
"/api/v4/user/certificates/{serial}": {
|
|
2172
|
+
"delete": {
|
|
2173
|
+
"tags": [
|
|
2174
|
+
"User"
|
|
2175
|
+
],
|
|
2176
|
+
"operationId": "revoke_user_certificate",
|
|
2177
|
+
"summary": "Revoke a user certificate",
|
|
2178
|
+
"description": "Revokes a user certificate issued by this CA and adds it to the user Key Revocation List. The `Proof-Of-Possession` header must contain a proof of possession of the private key for the public key that the certificate was issued for, made for this request. A certificate issued for a different public key is reported as not found.",
|
|
2179
|
+
"parameters": [
|
|
2180
|
+
{
|
|
2181
|
+
"schema": {
|
|
2182
|
+
"type": "string",
|
|
2183
|
+
"pattern": "^(0|[1-9]\\d*)$",
|
|
2184
|
+
"description": "Serial number of the certificate",
|
|
2185
|
+
"example": "12345678901234567890"
|
|
2186
|
+
},
|
|
2187
|
+
"required": true,
|
|
2188
|
+
"description": "Serial number of the certificate",
|
|
2189
|
+
"name": "serial",
|
|
2190
|
+
"in": "path"
|
|
2191
|
+
},
|
|
2192
|
+
{
|
|
2193
|
+
"schema": {
|
|
2194
|
+
"type": "string",
|
|
2195
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
2196
|
+
"example": "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K..."
|
|
2197
|
+
},
|
|
2198
|
+
"required": true,
|
|
2199
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
2200
|
+
"name": "Proof-Of-Possession",
|
|
2201
|
+
"in": "header"
|
|
2202
|
+
}
|
|
2203
|
+
],
|
|
2204
|
+
"responses": {
|
|
2205
|
+
"200": {
|
|
2206
|
+
"description": "SSH user certificate revoked successfully",
|
|
2207
|
+
"content": {
|
|
2208
|
+
"application/json": {
|
|
2209
|
+
"schema": {
|
|
2210
|
+
"$ref": "#/components/schemas/Revocation Response"
|
|
2211
|
+
}
|
|
2212
|
+
}
|
|
2213
|
+
}
|
|
2214
|
+
},
|
|
2215
|
+
"400": {
|
|
2216
|
+
"description": "Input Validation Error",
|
|
2217
|
+
"content": {
|
|
2218
|
+
"application/json": {
|
|
2219
|
+
"schema": {
|
|
2220
|
+
"type": "object",
|
|
2221
|
+
"properties": {
|
|
2222
|
+
"success": {
|
|
2223
|
+
"type": "boolean",
|
|
2224
|
+
"enum": [
|
|
2225
|
+
false
|
|
2226
|
+
]
|
|
2227
|
+
},
|
|
2228
|
+
"errors": {
|
|
2229
|
+
"type": "array",
|
|
2230
|
+
"items": {
|
|
2231
|
+
"type": "object",
|
|
2232
|
+
"properties": {
|
|
2233
|
+
"code": {
|
|
2234
|
+
"type": "number"
|
|
2235
|
+
},
|
|
2236
|
+
"message": {
|
|
2237
|
+
"type": "string"
|
|
2238
|
+
},
|
|
2239
|
+
"path": {
|
|
2240
|
+
"type": "array",
|
|
2241
|
+
"items": {
|
|
2242
|
+
"type": "string"
|
|
2243
|
+
}
|
|
2244
|
+
}
|
|
2245
|
+
},
|
|
2246
|
+
"required": [
|
|
2247
|
+
"code",
|
|
2248
|
+
"message",
|
|
2249
|
+
"path"
|
|
2250
|
+
]
|
|
2251
|
+
}
|
|
2252
|
+
}
|
|
2253
|
+
},
|
|
2254
|
+
"required": [
|
|
2255
|
+
"success",
|
|
2256
|
+
"errors"
|
|
2257
|
+
]
|
|
2258
|
+
}
|
|
2259
|
+
}
|
|
2260
|
+
}
|
|
2261
|
+
},
|
|
2262
|
+
"404": {
|
|
2263
|
+
"description": "Not Found",
|
|
2264
|
+
"content": {
|
|
2265
|
+
"application/json": {
|
|
2266
|
+
"schema": {
|
|
2267
|
+
"type": "object",
|
|
2268
|
+
"properties": {
|
|
2269
|
+
"success": {
|
|
2270
|
+
"type": "boolean",
|
|
2271
|
+
"enum": [
|
|
2272
|
+
false
|
|
2273
|
+
]
|
|
2274
|
+
},
|
|
2275
|
+
"errors": {
|
|
2276
|
+
"type": "array",
|
|
2277
|
+
"items": {
|
|
2278
|
+
"type": "object",
|
|
2279
|
+
"properties": {
|
|
2280
|
+
"code": {
|
|
2281
|
+
"type": "number"
|
|
2282
|
+
},
|
|
2283
|
+
"message": {
|
|
2284
|
+
"type": "string"
|
|
2285
|
+
}
|
|
2286
|
+
},
|
|
2287
|
+
"required": [
|
|
2288
|
+
"code",
|
|
2289
|
+
"message"
|
|
2290
|
+
]
|
|
2291
|
+
}
|
|
2292
|
+
}
|
|
2293
|
+
},
|
|
2294
|
+
"required": [
|
|
2295
|
+
"success",
|
|
2296
|
+
"errors"
|
|
2297
|
+
]
|
|
2298
|
+
}
|
|
2299
|
+
}
|
|
2300
|
+
}
|
|
2301
|
+
},
|
|
2302
|
+
"409": {
|
|
2303
|
+
"description": "Conflict",
|
|
2304
|
+
"content": {
|
|
2305
|
+
"application/json": {
|
|
2306
|
+
"schema": {
|
|
2307
|
+
"type": "object",
|
|
2308
|
+
"properties": {
|
|
2309
|
+
"success": {
|
|
2310
|
+
"type": "boolean",
|
|
2311
|
+
"enum": [
|
|
2312
|
+
false
|
|
2313
|
+
]
|
|
2314
|
+
},
|
|
2315
|
+
"errors": {
|
|
2316
|
+
"type": "array",
|
|
2317
|
+
"items": {
|
|
2318
|
+
"type": "object",
|
|
2319
|
+
"properties": {
|
|
2320
|
+
"code": {
|
|
2321
|
+
"type": "number"
|
|
2322
|
+
},
|
|
2323
|
+
"message": {
|
|
2324
|
+
"type": "string"
|
|
2325
|
+
}
|
|
2326
|
+
},
|
|
2327
|
+
"required": [
|
|
2328
|
+
"code",
|
|
2329
|
+
"message"
|
|
2330
|
+
]
|
|
2331
|
+
}
|
|
2332
|
+
}
|
|
2333
|
+
},
|
|
2334
|
+
"required": [
|
|
2335
|
+
"success",
|
|
2336
|
+
"errors"
|
|
2337
|
+
]
|
|
2338
|
+
}
|
|
2339
|
+
}
|
|
2340
|
+
}
|
|
2341
|
+
},
|
|
2342
|
+
"500": {
|
|
2343
|
+
"description": "Internal Server Error",
|
|
2344
|
+
"content": {
|
|
2345
|
+
"application/json": {
|
|
2346
|
+
"schema": {
|
|
2347
|
+
"type": "object",
|
|
2348
|
+
"properties": {
|
|
2349
|
+
"success": {
|
|
2350
|
+
"type": "boolean",
|
|
2351
|
+
"enum": [
|
|
2352
|
+
false
|
|
2353
|
+
]
|
|
2354
|
+
},
|
|
2355
|
+
"errors": {
|
|
2356
|
+
"type": "array",
|
|
2357
|
+
"items": {
|
|
2358
|
+
"type": "object",
|
|
2359
|
+
"properties": {
|
|
2360
|
+
"code": {
|
|
2361
|
+
"type": "number"
|
|
2362
|
+
},
|
|
2363
|
+
"message": {
|
|
2364
|
+
"type": "string"
|
|
2365
|
+
}
|
|
2366
|
+
},
|
|
2367
|
+
"required": [
|
|
2368
|
+
"code",
|
|
2369
|
+
"message"
|
|
2370
|
+
]
|
|
2371
|
+
}
|
|
2372
|
+
}
|
|
2373
|
+
},
|
|
2374
|
+
"required": [
|
|
2375
|
+
"success",
|
|
2376
|
+
"errors"
|
|
2377
|
+
]
|
|
2378
|
+
}
|
|
2379
|
+
}
|
|
2380
|
+
}
|
|
2381
|
+
}
|
|
2382
|
+
}
|
|
2383
|
+
}
|
|
2384
|
+
},
|
|
2385
|
+
"/api/v4/user/krl": {
|
|
2386
|
+
"get": {
|
|
2387
|
+
"tags": [
|
|
2388
|
+
"User"
|
|
2389
|
+
],
|
|
2390
|
+
"summary": "Get the Key Revocation List for user certificates",
|
|
2391
|
+
"description": "Returns the OpenSSH Key Revocation List (KRL) of revoked user certificates issued by this CA, along with an SSHSIG signature made by the CA key so the KRL can be verified before use.",
|
|
2392
|
+
"operationId": "get_user_revocation_list",
|
|
2393
|
+
"responses": {
|
|
2394
|
+
"200": {
|
|
2395
|
+
"description": "Returns an Open SSH Key Revocation List of revoked user certificates as BASE64 and an SSHSIG signature for verification",
|
|
2396
|
+
"content": {
|
|
2397
|
+
"application/json": {
|
|
2398
|
+
"schema": {
|
|
2399
|
+
"$ref": "#/components/schemas/Key Revocation List Response"
|
|
2400
|
+
}
|
|
2401
|
+
}
|
|
2402
|
+
}
|
|
2403
|
+
},
|
|
2404
|
+
"500": {
|
|
2405
|
+
"description": "Internal Server Error",
|
|
2406
|
+
"content": {
|
|
2407
|
+
"application/json": {
|
|
2408
|
+
"schema": {
|
|
2409
|
+
"type": "object",
|
|
2410
|
+
"properties": {
|
|
2411
|
+
"success": {
|
|
2412
|
+
"type": "boolean",
|
|
2413
|
+
"enum": [
|
|
2414
|
+
false
|
|
2415
|
+
]
|
|
2416
|
+
},
|
|
2417
|
+
"errors": {
|
|
2418
|
+
"type": "array",
|
|
2419
|
+
"items": {
|
|
2420
|
+
"type": "object",
|
|
2421
|
+
"properties": {
|
|
2422
|
+
"code": {
|
|
2423
|
+
"type": "number"
|
|
2424
|
+
},
|
|
2425
|
+
"message": {
|
|
2426
|
+
"type": "string"
|
|
2427
|
+
}
|
|
2428
|
+
},
|
|
2429
|
+
"required": [
|
|
2430
|
+
"code",
|
|
2431
|
+
"message"
|
|
2432
|
+
]
|
|
2433
|
+
}
|
|
2434
|
+
}
|
|
2435
|
+
},
|
|
2436
|
+
"required": [
|
|
2437
|
+
"success",
|
|
2438
|
+
"errors"
|
|
2439
|
+
]
|
|
2440
|
+
}
|
|
2441
|
+
}
|
|
2442
|
+
}
|
|
2443
|
+
}
|
|
2444
|
+
}
|
|
2445
|
+
}
|
|
2446
|
+
},
|
|
2447
|
+
"/api/v4/host/certificates": {
|
|
2448
|
+
"post": {
|
|
2449
|
+
"tags": [
|
|
2450
|
+
"Host"
|
|
2451
|
+
],
|
|
2452
|
+
"operationId": "issue_host_certificate",
|
|
2453
|
+
"summary": "Request a host certificate",
|
|
2454
|
+
"description": "Issues a signed SSH host certificate for the provided public key and principals. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key for `public_key` in the `Proof-Of-Possession` header made for this request. The user must be permitted to request host certificates by email address or role.",
|
|
2455
|
+
"security": [
|
|
2456
|
+
{
|
|
2457
|
+
"oidcAuth": []
|
|
2458
|
+
}
|
|
2459
|
+
],
|
|
2460
|
+
"parameters": [
|
|
2461
|
+
{
|
|
2462
|
+
"schema": {
|
|
2463
|
+
"type": "string",
|
|
2464
|
+
"description": "Access Token JWT from OIDC IdP",
|
|
2465
|
+
"example": "Bearer eyJ..."
|
|
2466
|
+
},
|
|
2467
|
+
"required": true,
|
|
2468
|
+
"description": "Access Token JWT from OIDC IdP",
|
|
2469
|
+
"name": "Authorization",
|
|
2470
|
+
"in": "header"
|
|
2471
|
+
},
|
|
2472
|
+
{
|
|
2473
|
+
"schema": {
|
|
2474
|
+
"type": "string",
|
|
2475
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
2476
|
+
"example": "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K..."
|
|
2477
|
+
},
|
|
2478
|
+
"required": true,
|
|
2479
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
2480
|
+
"name": "Proof-Of-Possession",
|
|
2481
|
+
"in": "header"
|
|
2482
|
+
}
|
|
2483
|
+
],
|
|
2484
|
+
"requestBody": {
|
|
2485
|
+
"content": {
|
|
2486
|
+
"application/json": {
|
|
2487
|
+
"schema": {
|
|
2488
|
+
"$ref": "#/components/schemas/Host Certificate Issue Request"
|
|
2489
|
+
}
|
|
2490
|
+
}
|
|
2491
|
+
}
|
|
2492
|
+
},
|
|
2493
|
+
"responses": {
|
|
2494
|
+
"200": {
|
|
2495
|
+
"description": "SSH Host Certificate issued successfully",
|
|
2496
|
+
"content": {
|
|
2497
|
+
"application/json": {
|
|
2498
|
+
"schema": {
|
|
2499
|
+
"$ref": "#/components/schemas/Certificate Response"
|
|
2500
|
+
}
|
|
2501
|
+
}
|
|
2502
|
+
}
|
|
2503
|
+
},
|
|
2504
|
+
"400": {
|
|
2505
|
+
"description": "Input Validation Error",
|
|
2506
|
+
"content": {
|
|
2507
|
+
"application/json": {
|
|
2508
|
+
"schema": {
|
|
2509
|
+
"type": "object",
|
|
2510
|
+
"properties": {
|
|
2511
|
+
"success": {
|
|
2512
|
+
"type": "boolean",
|
|
2513
|
+
"enum": [
|
|
2514
|
+
false
|
|
2515
|
+
]
|
|
2516
|
+
},
|
|
2517
|
+
"errors": {
|
|
2518
|
+
"type": "array",
|
|
2519
|
+
"items": {
|
|
2520
|
+
"type": "object",
|
|
2521
|
+
"properties": {
|
|
2522
|
+
"code": {
|
|
2523
|
+
"type": "number"
|
|
2524
|
+
},
|
|
2525
|
+
"message": {
|
|
2526
|
+
"type": "string"
|
|
2527
|
+
},
|
|
2528
|
+
"path": {
|
|
2529
|
+
"type": "array",
|
|
2530
|
+
"items": {
|
|
2531
|
+
"type": "string"
|
|
2532
|
+
}
|
|
2533
|
+
}
|
|
2534
|
+
},
|
|
2535
|
+
"required": [
|
|
2536
|
+
"code",
|
|
2537
|
+
"message",
|
|
2538
|
+
"path"
|
|
2539
|
+
]
|
|
2540
|
+
}
|
|
2541
|
+
}
|
|
2542
|
+
},
|
|
2543
|
+
"required": [
|
|
2544
|
+
"success",
|
|
2545
|
+
"errors"
|
|
2546
|
+
]
|
|
2547
|
+
}
|
|
2548
|
+
}
|
|
2549
|
+
}
|
|
2550
|
+
},
|
|
2551
|
+
"401": {
|
|
2552
|
+
"description": "Unauthorized",
|
|
2553
|
+
"content": {
|
|
2554
|
+
"application/json": {
|
|
2555
|
+
"schema": {
|
|
2556
|
+
"type": "object",
|
|
2557
|
+
"properties": {
|
|
2558
|
+
"success": {
|
|
2559
|
+
"type": "boolean",
|
|
2560
|
+
"enum": [
|
|
2561
|
+
false
|
|
2562
|
+
]
|
|
2563
|
+
},
|
|
2564
|
+
"errors": {
|
|
2565
|
+
"type": "array",
|
|
2566
|
+
"items": {
|
|
2567
|
+
"type": "object",
|
|
2568
|
+
"properties": {
|
|
2569
|
+
"code": {
|
|
2570
|
+
"type": "number"
|
|
2571
|
+
},
|
|
2572
|
+
"message": {
|
|
2573
|
+
"type": "string"
|
|
2574
|
+
}
|
|
2575
|
+
},
|
|
2576
|
+
"required": [
|
|
2577
|
+
"code",
|
|
2578
|
+
"message"
|
|
2579
|
+
]
|
|
2580
|
+
}
|
|
2581
|
+
}
|
|
2582
|
+
},
|
|
2583
|
+
"required": [
|
|
2584
|
+
"success",
|
|
2585
|
+
"errors"
|
|
2586
|
+
]
|
|
2587
|
+
}
|
|
2588
|
+
}
|
|
2589
|
+
}
|
|
2590
|
+
},
|
|
2591
|
+
"403": {
|
|
2592
|
+
"description": "Forbidden",
|
|
2593
|
+
"content": {
|
|
2594
|
+
"application/json": {
|
|
2595
|
+
"schema": {
|
|
2596
|
+
"type": "object",
|
|
2597
|
+
"properties": {
|
|
2598
|
+
"success": {
|
|
2599
|
+
"type": "boolean",
|
|
2600
|
+
"enum": [
|
|
2601
|
+
false
|
|
2602
|
+
]
|
|
2603
|
+
},
|
|
2604
|
+
"errors": {
|
|
2605
|
+
"type": "array",
|
|
2606
|
+
"items": {
|
|
2607
|
+
"type": "object",
|
|
2608
|
+
"properties": {
|
|
2609
|
+
"code": {
|
|
2610
|
+
"type": "number"
|
|
2611
|
+
},
|
|
2612
|
+
"message": {
|
|
2613
|
+
"type": "string"
|
|
2614
|
+
}
|
|
2615
|
+
},
|
|
2616
|
+
"required": [
|
|
2617
|
+
"code",
|
|
2618
|
+
"message"
|
|
2619
|
+
]
|
|
2620
|
+
}
|
|
2621
|
+
}
|
|
2622
|
+
},
|
|
2623
|
+
"required": [
|
|
2624
|
+
"success",
|
|
2625
|
+
"errors"
|
|
2626
|
+
]
|
|
2627
|
+
}
|
|
2628
|
+
}
|
|
2629
|
+
}
|
|
2630
|
+
},
|
|
2631
|
+
"422": {
|
|
2632
|
+
"description": "Unprocessable Entity",
|
|
2633
|
+
"content": {
|
|
2634
|
+
"application/json": {
|
|
2635
|
+
"schema": {
|
|
2636
|
+
"type": "object",
|
|
2637
|
+
"properties": {
|
|
2638
|
+
"success": {
|
|
2639
|
+
"type": "boolean",
|
|
2640
|
+
"enum": [
|
|
2641
|
+
false
|
|
2642
|
+
]
|
|
2643
|
+
},
|
|
2644
|
+
"errors": {
|
|
2645
|
+
"type": "array",
|
|
2646
|
+
"items": {
|
|
2647
|
+
"type": "object",
|
|
2648
|
+
"properties": {
|
|
2649
|
+
"code": {
|
|
2650
|
+
"type": "number"
|
|
2651
|
+
},
|
|
2652
|
+
"message": {
|
|
2653
|
+
"type": "string"
|
|
2654
|
+
},
|
|
2655
|
+
"path": {
|
|
2656
|
+
"type": "array",
|
|
2657
|
+
"items": {
|
|
2658
|
+
"type": "string"
|
|
2659
|
+
}
|
|
2660
|
+
}
|
|
2661
|
+
},
|
|
2662
|
+
"required": [
|
|
2663
|
+
"code",
|
|
2664
|
+
"message",
|
|
2665
|
+
"path"
|
|
2666
|
+
]
|
|
2667
|
+
}
|
|
2668
|
+
}
|
|
2669
|
+
},
|
|
2670
|
+
"required": [
|
|
2671
|
+
"success",
|
|
2672
|
+
"errors"
|
|
2673
|
+
]
|
|
2674
|
+
}
|
|
2675
|
+
}
|
|
2676
|
+
}
|
|
2677
|
+
},
|
|
2678
|
+
"500": {
|
|
2679
|
+
"description": "Internal Server Error",
|
|
2680
|
+
"content": {
|
|
2681
|
+
"application/json": {
|
|
2682
|
+
"schema": {
|
|
2683
|
+
"type": "object",
|
|
2684
|
+
"properties": {
|
|
2685
|
+
"success": {
|
|
2686
|
+
"type": "boolean",
|
|
2687
|
+
"enum": [
|
|
2688
|
+
false
|
|
2689
|
+
]
|
|
2690
|
+
},
|
|
2691
|
+
"errors": {
|
|
2692
|
+
"type": "array",
|
|
2693
|
+
"items": {
|
|
2694
|
+
"type": "object",
|
|
2695
|
+
"properties": {
|
|
2696
|
+
"code": {
|
|
2697
|
+
"type": "number"
|
|
2698
|
+
},
|
|
2699
|
+
"message": {
|
|
2700
|
+
"type": "string"
|
|
2701
|
+
}
|
|
2702
|
+
},
|
|
2703
|
+
"required": [
|
|
2704
|
+
"code",
|
|
2705
|
+
"message"
|
|
2706
|
+
]
|
|
2707
|
+
}
|
|
2708
|
+
}
|
|
2709
|
+
},
|
|
2710
|
+
"required": [
|
|
2711
|
+
"success",
|
|
2712
|
+
"errors"
|
|
2713
|
+
]
|
|
2714
|
+
}
|
|
2715
|
+
}
|
|
2716
|
+
}
|
|
2717
|
+
}
|
|
2718
|
+
}
|
|
2719
|
+
}
|
|
2720
|
+
},
|
|
2721
|
+
"/api/v4/host/certificates/{serial}/renew": {
|
|
2722
|
+
"post": {
|
|
2723
|
+
"tags": [
|
|
2724
|
+
"Host"
|
|
2725
|
+
],
|
|
2726
|
+
"operationId": "renew_host_certificate",
|
|
2727
|
+
"summary": "Renew a host certificate",
|
|
2728
|
+
"description": "Issues a new SSH host certificate for the same public key and principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the `Proof-Of-Possession` header must contain a proof of possession of the private key for the existing certificate made for this request. The lifetime of the renewed certificate is no longer than that of the existing certificate.",
|
|
2729
|
+
"parameters": [
|
|
2730
|
+
{
|
|
2731
|
+
"schema": {
|
|
2732
|
+
"type": "string",
|
|
2733
|
+
"pattern": "^(0|[1-9]\\d*)$",
|
|
2734
|
+
"description": "Serial number of the certificate",
|
|
2735
|
+
"example": "12345678901234567890"
|
|
2736
|
+
},
|
|
2737
|
+
"required": true,
|
|
2738
|
+
"description": "Serial number of the certificate",
|
|
2739
|
+
"name": "serial",
|
|
2740
|
+
"in": "path"
|
|
2741
|
+
},
|
|
2742
|
+
{
|
|
2743
|
+
"schema": {
|
|
2744
|
+
"type": "string",
|
|
2745
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
2746
|
+
"example": "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K..."
|
|
2747
|
+
},
|
|
2748
|
+
"required": true,
|
|
2749
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
2750
|
+
"name": "Proof-Of-Possession",
|
|
2751
|
+
"in": "header"
|
|
2752
|
+
}
|
|
2753
|
+
],
|
|
2754
|
+
"requestBody": {
|
|
2755
|
+
"content": {
|
|
2756
|
+
"application/json": {
|
|
2757
|
+
"schema": {
|
|
2758
|
+
"$ref": "#/components/schemas/Host Certificate Renewal Request"
|
|
2759
|
+
}
|
|
2760
|
+
}
|
|
2761
|
+
}
|
|
2762
|
+
},
|
|
2763
|
+
"responses": {
|
|
2764
|
+
"200": {
|
|
2765
|
+
"description": "SSH Host Certificate renewed successfully",
|
|
2766
|
+
"content": {
|
|
2767
|
+
"application/json": {
|
|
2768
|
+
"schema": {
|
|
2769
|
+
"$ref": "#/components/schemas/Certificate Response"
|
|
2770
|
+
}
|
|
2771
|
+
}
|
|
2772
|
+
}
|
|
2773
|
+
},
|
|
2774
|
+
"400": {
|
|
2775
|
+
"description": "Input Validation Error",
|
|
2776
|
+
"content": {
|
|
2777
|
+
"application/json": {
|
|
2778
|
+
"schema": {
|
|
2779
|
+
"type": "object",
|
|
2780
|
+
"properties": {
|
|
2781
|
+
"success": {
|
|
2782
|
+
"type": "boolean",
|
|
2783
|
+
"enum": [
|
|
2784
|
+
false
|
|
2785
|
+
]
|
|
2786
|
+
},
|
|
2787
|
+
"errors": {
|
|
2788
|
+
"type": "array",
|
|
2789
|
+
"items": {
|
|
2790
|
+
"type": "object",
|
|
2791
|
+
"properties": {
|
|
2792
|
+
"code": {
|
|
2793
|
+
"type": "number"
|
|
2794
|
+
},
|
|
2795
|
+
"message": {
|
|
2796
|
+
"type": "string"
|
|
2797
|
+
},
|
|
2798
|
+
"path": {
|
|
2799
|
+
"type": "array",
|
|
2800
|
+
"items": {
|
|
2801
|
+
"type": "string"
|
|
2802
|
+
}
|
|
2803
|
+
}
|
|
2804
|
+
},
|
|
2805
|
+
"required": [
|
|
2806
|
+
"code",
|
|
2807
|
+
"message",
|
|
2808
|
+
"path"
|
|
2809
|
+
]
|
|
2810
|
+
}
|
|
2811
|
+
}
|
|
2812
|
+
},
|
|
2813
|
+
"required": [
|
|
2814
|
+
"success",
|
|
2815
|
+
"errors"
|
|
2816
|
+
]
|
|
2817
|
+
}
|
|
2818
|
+
}
|
|
2819
|
+
}
|
|
2820
|
+
},
|
|
2821
|
+
"401": {
|
|
2822
|
+
"description": "Unauthorized",
|
|
2823
|
+
"content": {
|
|
2824
|
+
"application/json": {
|
|
2825
|
+
"schema": {
|
|
2826
|
+
"type": "object",
|
|
2827
|
+
"properties": {
|
|
2828
|
+
"success": {
|
|
2829
|
+
"type": "boolean",
|
|
2830
|
+
"enum": [
|
|
2831
|
+
false
|
|
2832
|
+
]
|
|
2833
|
+
},
|
|
2834
|
+
"errors": {
|
|
2835
|
+
"type": "array",
|
|
2836
|
+
"items": {
|
|
2837
|
+
"type": "object",
|
|
2838
|
+
"properties": {
|
|
2839
|
+
"code": {
|
|
2840
|
+
"type": "number"
|
|
2841
|
+
},
|
|
2842
|
+
"message": {
|
|
2843
|
+
"type": "string"
|
|
2844
|
+
}
|
|
2845
|
+
},
|
|
2846
|
+
"required": [
|
|
2847
|
+
"code",
|
|
2848
|
+
"message"
|
|
2849
|
+
]
|
|
2850
|
+
}
|
|
2851
|
+
}
|
|
2852
|
+
},
|
|
2853
|
+
"required": [
|
|
2854
|
+
"success",
|
|
2855
|
+
"errors"
|
|
2856
|
+
]
|
|
2857
|
+
}
|
|
2858
|
+
}
|
|
2859
|
+
}
|
|
2860
|
+
},
|
|
2861
|
+
"403": {
|
|
2862
|
+
"description": "Forbidden",
|
|
2863
|
+
"content": {
|
|
2864
|
+
"application/json": {
|
|
2865
|
+
"schema": {
|
|
2866
|
+
"type": "object",
|
|
2867
|
+
"properties": {
|
|
2868
|
+
"success": {
|
|
2869
|
+
"type": "boolean",
|
|
2870
|
+
"enum": [
|
|
2871
|
+
false
|
|
2872
|
+
]
|
|
2873
|
+
},
|
|
2874
|
+
"errors": {
|
|
2875
|
+
"type": "array",
|
|
2876
|
+
"items": {
|
|
2877
|
+
"type": "object",
|
|
2878
|
+
"properties": {
|
|
2879
|
+
"code": {
|
|
2880
|
+
"type": "number"
|
|
2881
|
+
},
|
|
2882
|
+
"message": {
|
|
2883
|
+
"type": "string"
|
|
2884
|
+
}
|
|
2885
|
+
},
|
|
2886
|
+
"required": [
|
|
2887
|
+
"code",
|
|
2888
|
+
"message"
|
|
2889
|
+
]
|
|
2890
|
+
}
|
|
2891
|
+
}
|
|
2892
|
+
},
|
|
2893
|
+
"required": [
|
|
2894
|
+
"success",
|
|
2895
|
+
"errors"
|
|
2896
|
+
]
|
|
2897
|
+
}
|
|
2898
|
+
}
|
|
2899
|
+
}
|
|
2900
|
+
},
|
|
2901
|
+
"422": {
|
|
2902
|
+
"description": "Unprocessable Entity",
|
|
2903
|
+
"content": {
|
|
2904
|
+
"application/json": {
|
|
2905
|
+
"schema": {
|
|
2906
|
+
"type": "object",
|
|
2907
|
+
"properties": {
|
|
2908
|
+
"success": {
|
|
2909
|
+
"type": "boolean",
|
|
2910
|
+
"enum": [
|
|
2911
|
+
false
|
|
2912
|
+
]
|
|
2913
|
+
},
|
|
2914
|
+
"errors": {
|
|
2915
|
+
"type": "array",
|
|
2916
|
+
"items": {
|
|
2917
|
+
"type": "object",
|
|
2918
|
+
"properties": {
|
|
2919
|
+
"code": {
|
|
2920
|
+
"type": "number"
|
|
2921
|
+
},
|
|
2922
|
+
"message": {
|
|
2923
|
+
"type": "string"
|
|
2924
|
+
},
|
|
2925
|
+
"path": {
|
|
2926
|
+
"type": "array",
|
|
2927
|
+
"items": {
|
|
2928
|
+
"type": "string"
|
|
2929
|
+
}
|
|
2930
|
+
}
|
|
2931
|
+
},
|
|
2932
|
+
"required": [
|
|
2933
|
+
"code",
|
|
2934
|
+
"message",
|
|
2935
|
+
"path"
|
|
2936
|
+
]
|
|
2937
|
+
}
|
|
2938
|
+
}
|
|
2939
|
+
},
|
|
2940
|
+
"required": [
|
|
2941
|
+
"success",
|
|
2942
|
+
"errors"
|
|
2943
|
+
]
|
|
2944
|
+
}
|
|
2945
|
+
}
|
|
2946
|
+
}
|
|
2947
|
+
},
|
|
2948
|
+
"500": {
|
|
2949
|
+
"description": "Internal Server Error",
|
|
2950
|
+
"content": {
|
|
2951
|
+
"application/json": {
|
|
2952
|
+
"schema": {
|
|
2953
|
+
"type": "object",
|
|
2954
|
+
"properties": {
|
|
2955
|
+
"success": {
|
|
2956
|
+
"type": "boolean",
|
|
2957
|
+
"enum": [
|
|
2958
|
+
false
|
|
2959
|
+
]
|
|
2960
|
+
},
|
|
2961
|
+
"errors": {
|
|
2962
|
+
"type": "array",
|
|
2963
|
+
"items": {
|
|
2964
|
+
"type": "object",
|
|
2965
|
+
"properties": {
|
|
2966
|
+
"code": {
|
|
2967
|
+
"type": "number"
|
|
2968
|
+
},
|
|
2969
|
+
"message": {
|
|
2970
|
+
"type": "string"
|
|
2971
|
+
}
|
|
2972
|
+
},
|
|
2973
|
+
"required": [
|
|
2974
|
+
"code",
|
|
2975
|
+
"message"
|
|
2976
|
+
]
|
|
2977
|
+
}
|
|
2978
|
+
}
|
|
2979
|
+
},
|
|
2980
|
+
"required": [
|
|
2981
|
+
"success",
|
|
2982
|
+
"errors"
|
|
2983
|
+
]
|
|
2984
|
+
}
|
|
2985
|
+
}
|
|
2986
|
+
}
|
|
2987
|
+
}
|
|
2988
|
+
}
|
|
2989
|
+
}
|
|
2990
|
+
},
|
|
2991
|
+
"/api/v4/host/certificates/{serial}": {
|
|
2992
|
+
"delete": {
|
|
2993
|
+
"tags": [
|
|
2994
|
+
"Host"
|
|
2995
|
+
],
|
|
2996
|
+
"operationId": "revoke_host_certificate",
|
|
2997
|
+
"summary": "Revoke a host certificate",
|
|
2998
|
+
"description": "Revokes a host certificate issued by this CA and adds it to the host Key Revocation List. The `Proof-Of-Possession` header must contain a proof of possession of the private key for the public key that the certificate was issued for, made for this request. A certificate issued for a different public key is reported as not found.",
|
|
2999
|
+
"parameters": [
|
|
3000
|
+
{
|
|
3001
|
+
"schema": {
|
|
3002
|
+
"type": "string",
|
|
3003
|
+
"pattern": "^(0|[1-9]\\d*)$",
|
|
3004
|
+
"description": "Serial number of the certificate",
|
|
3005
|
+
"example": "12345678901234567890"
|
|
3006
|
+
},
|
|
3007
|
+
"required": true,
|
|
3008
|
+
"description": "Serial number of the certificate",
|
|
3009
|
+
"name": "serial",
|
|
3010
|
+
"in": "path"
|
|
3011
|
+
},
|
|
3012
|
+
{
|
|
3013
|
+
"schema": {
|
|
3014
|
+
"type": "string",
|
|
3015
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
3016
|
+
"example": "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K..."
|
|
3017
|
+
},
|
|
3018
|
+
"required": true,
|
|
3019
|
+
"description": "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
|
|
3020
|
+
"name": "Proof-Of-Possession",
|
|
3021
|
+
"in": "header"
|
|
3022
|
+
}
|
|
3023
|
+
],
|
|
3024
|
+
"responses": {
|
|
3025
|
+
"200": {
|
|
3026
|
+
"description": "SSH host certificate revoked successfully",
|
|
3027
|
+
"content": {
|
|
3028
|
+
"application/json": {
|
|
3029
|
+
"schema": {
|
|
3030
|
+
"$ref": "#/components/schemas/Revocation Response"
|
|
3031
|
+
}
|
|
3032
|
+
}
|
|
3033
|
+
}
|
|
3034
|
+
},
|
|
3035
|
+
"400": {
|
|
3036
|
+
"description": "Input Validation Error",
|
|
1301
3037
|
"content": {
|
|
1302
3038
|
"application/json": {
|
|
1303
3039
|
"schema": {
|
|
@@ -1343,6 +3079,148 @@
|
|
|
1343
3079
|
}
|
|
1344
3080
|
}
|
|
1345
3081
|
},
|
|
3082
|
+
"404": {
|
|
3083
|
+
"description": "Not Found",
|
|
3084
|
+
"content": {
|
|
3085
|
+
"application/json": {
|
|
3086
|
+
"schema": {
|
|
3087
|
+
"type": "object",
|
|
3088
|
+
"properties": {
|
|
3089
|
+
"success": {
|
|
3090
|
+
"type": "boolean",
|
|
3091
|
+
"enum": [
|
|
3092
|
+
false
|
|
3093
|
+
]
|
|
3094
|
+
},
|
|
3095
|
+
"errors": {
|
|
3096
|
+
"type": "array",
|
|
3097
|
+
"items": {
|
|
3098
|
+
"type": "object",
|
|
3099
|
+
"properties": {
|
|
3100
|
+
"code": {
|
|
3101
|
+
"type": "number"
|
|
3102
|
+
},
|
|
3103
|
+
"message": {
|
|
3104
|
+
"type": "string"
|
|
3105
|
+
}
|
|
3106
|
+
},
|
|
3107
|
+
"required": [
|
|
3108
|
+
"code",
|
|
3109
|
+
"message"
|
|
3110
|
+
]
|
|
3111
|
+
}
|
|
3112
|
+
}
|
|
3113
|
+
},
|
|
3114
|
+
"required": [
|
|
3115
|
+
"success",
|
|
3116
|
+
"errors"
|
|
3117
|
+
]
|
|
3118
|
+
}
|
|
3119
|
+
}
|
|
3120
|
+
}
|
|
3121
|
+
},
|
|
3122
|
+
"409": {
|
|
3123
|
+
"description": "Conflict",
|
|
3124
|
+
"content": {
|
|
3125
|
+
"application/json": {
|
|
3126
|
+
"schema": {
|
|
3127
|
+
"type": "object",
|
|
3128
|
+
"properties": {
|
|
3129
|
+
"success": {
|
|
3130
|
+
"type": "boolean",
|
|
3131
|
+
"enum": [
|
|
3132
|
+
false
|
|
3133
|
+
]
|
|
3134
|
+
},
|
|
3135
|
+
"errors": {
|
|
3136
|
+
"type": "array",
|
|
3137
|
+
"items": {
|
|
3138
|
+
"type": "object",
|
|
3139
|
+
"properties": {
|
|
3140
|
+
"code": {
|
|
3141
|
+
"type": "number"
|
|
3142
|
+
},
|
|
3143
|
+
"message": {
|
|
3144
|
+
"type": "string"
|
|
3145
|
+
}
|
|
3146
|
+
},
|
|
3147
|
+
"required": [
|
|
3148
|
+
"code",
|
|
3149
|
+
"message"
|
|
3150
|
+
]
|
|
3151
|
+
}
|
|
3152
|
+
}
|
|
3153
|
+
},
|
|
3154
|
+
"required": [
|
|
3155
|
+
"success",
|
|
3156
|
+
"errors"
|
|
3157
|
+
]
|
|
3158
|
+
}
|
|
3159
|
+
}
|
|
3160
|
+
}
|
|
3161
|
+
},
|
|
3162
|
+
"500": {
|
|
3163
|
+
"description": "Internal Server Error",
|
|
3164
|
+
"content": {
|
|
3165
|
+
"application/json": {
|
|
3166
|
+
"schema": {
|
|
3167
|
+
"type": "object",
|
|
3168
|
+
"properties": {
|
|
3169
|
+
"success": {
|
|
3170
|
+
"type": "boolean",
|
|
3171
|
+
"enum": [
|
|
3172
|
+
false
|
|
3173
|
+
]
|
|
3174
|
+
},
|
|
3175
|
+
"errors": {
|
|
3176
|
+
"type": "array",
|
|
3177
|
+
"items": {
|
|
3178
|
+
"type": "object",
|
|
3179
|
+
"properties": {
|
|
3180
|
+
"code": {
|
|
3181
|
+
"type": "number"
|
|
3182
|
+
},
|
|
3183
|
+
"message": {
|
|
3184
|
+
"type": "string"
|
|
3185
|
+
}
|
|
3186
|
+
},
|
|
3187
|
+
"required": [
|
|
3188
|
+
"code",
|
|
3189
|
+
"message"
|
|
3190
|
+
]
|
|
3191
|
+
}
|
|
3192
|
+
}
|
|
3193
|
+
},
|
|
3194
|
+
"required": [
|
|
3195
|
+
"success",
|
|
3196
|
+
"errors"
|
|
3197
|
+
]
|
|
3198
|
+
}
|
|
3199
|
+
}
|
|
3200
|
+
}
|
|
3201
|
+
}
|
|
3202
|
+
}
|
|
3203
|
+
}
|
|
3204
|
+
},
|
|
3205
|
+
"/api/v4/host/krl": {
|
|
3206
|
+
"get": {
|
|
3207
|
+
"tags": [
|
|
3208
|
+
"Host"
|
|
3209
|
+
],
|
|
3210
|
+
"summary": "Get the Key Revocation List for host certificates",
|
|
3211
|
+
"description": "Returns the OpenSSH Key Revocation List (KRL) of revoked host certificates issued by this CA, along with an SSHSIG signature made by the CA key so the KRL can be verified before use.",
|
|
3212
|
+
"operationId": "get_host_revocation_list",
|
|
3213
|
+
"responses": {
|
|
3214
|
+
"200": {
|
|
3215
|
+
"description": "Returns an Open SSH Key Revocation List of revoked host certificates as BASE64 and an SSHSIG signature for verification",
|
|
3216
|
+
"content": {
|
|
3217
|
+
"application/json": {
|
|
3218
|
+
"schema": {
|
|
3219
|
+
"$ref": "#/components/schemas/Key Revocation List Response"
|
|
3220
|
+
}
|
|
3221
|
+
}
|
|
3222
|
+
}
|
|
3223
|
+
},
|
|
1346
3224
|
"500": {
|
|
1347
3225
|
"description": "Internal Server Error",
|
|
1348
3226
|
"content": {
|