Merge pull request #452 from openziti/session.certs

adds support of API Session Certificates

controller/env/appenv.go

@@ -126,6 +126,10 @@ func (ae *AppEnv) GetMetricsRegistry() metrics.Registry {
 	return ae.HostController.GetNetwork().GetMetricsRegistry()
 }
 
+func (ae *AppEnv) GetFingerprintGenerator() cert.FingerprintGenerator {
+	return ae.FingerprintGenerator
+}
+
 type HostController interface {
 	RegisterXctrl(x xctrl.Xctrl) error
 	RegisterXmgmt(x xmgmt.Xmgmt) error
@@ -280,11 +284,11 @@ func NewAppEnv(c *edgeConfig.Config) *AppEnv {
 			Api:           "1.0.0",
 			EnrollmentApi: "1.0.0",
 		},
-		AuthCookieName:    constants.ZitiSession,
-		AuthHeaderName:    constants.ZitiSession,
-		AuthRegistry:      &model.AuthProcessorRegistryImpl{},
-		EnrollRegistry:    &model.EnrollmentRegistryImpl{},
-		Api:               api,
+		AuthCookieName: constants.ZitiSession,
+		AuthHeaderName: constants.ZitiSession,
+		AuthRegistry:   &model.AuthProcessorRegistryImpl{},
+		EnrollRegistry: &model.EnrollmentRegistryImpl{},
+		Api:            api,
 	}
 
 	api.APIAuthorizer = authorizer{}

controller/env/broker.go

@@ -29,6 +29,7 @@ import (
 	"github.com/openziti/foundation/channel2"
 	"github.com/openziti/foundation/storage/boltz"
 	"github.com/openziti/foundation/util/concurrenz"
+	"go.etcd.io/bbolt"
 	"sync"
 	"time"
 )
@@ -193,6 +194,14 @@ func NewBroker(ae *AppEnv) *Broker {
 				b.apiSessionDeleteEventHandler,
 			},
 		},
+		b.ae.GetStores().ApiSessionCertificate: {
+			boltz.EventCreate: []events.Listener{
+				b.apiSessionCertificateEventHandler,
+			},
+			boltz.EventDelete: []events.Listener{
+				b.apiSessionCertificateEventHandler,
+			},
+		},
 	}
 
 	b.registerEventHandlers()
@@ -280,7 +289,7 @@ func (b *Broker) sendApiSessionCreates(apiSession *persistence.ApiSession) {
 
 	apiSessionMsg.IsFullState = false
 
-	fingerprints, err := b.getApiSessionFingerprints(apiSession.IdentityId)
+	fingerprints, err := b.getFingerprints(apiSession.IdentityId, apiSession.Id)
 	if err != nil {
 		pfxlog.Logger().WithError(err).Errorf("could not get session fingerprints")
 		return
@@ -293,6 +302,7 @@ func (b *Broker) sendApiSessionCreates(apiSession *persistence.ApiSession) {
 	apiSessionMsg.ApiSessions = append(apiSessionMsg.ApiSessions, &edge_ctrl_pb.ApiSession{
 		Token:            apiSession.Token,
 		CertFingerprints: fingerprints,
+		Id:               apiSession.Id,
 	})
 
 	byteMsg, err := proto.Marshal(apiSessionMsg)
@@ -326,7 +336,7 @@ func (b *Broker) apiSessionUpdateEventHandler(args ...interface{}) {
 func (b *Broker) sendApiSessionUpdates(apiSession *persistence.ApiSession) {
 	apiSessionMsg := &edge_ctrl_pb.ApiSessionUpdated{}
 
-	fingerprints, err := b.getApiSessionFingerprints(apiSession.IdentityId)
+	fingerprints, err := b.getFingerprints(apiSession.IdentityId, apiSession.Id)
 	if err != nil {
 		pfxlog.Logger().WithError(err).Errorf("could not get api session fingerprints")
 		return
@@ -340,6 +350,7 @@ func (b *Broker) sendApiSessionUpdates(apiSession *persistence.ApiSession) {
 	apiSessionMsg.ApiSessions = append(apiSessionMsg.ApiSessions, &edge_ctrl_pb.ApiSession{
 		Token:            apiSession.Token,
 		CertFingerprints: fingerprints,
+		Id:               apiSession.Id,
 	})
 
 	byteMsg, err := proto.Marshal(apiSessionMsg)
@@ -459,7 +470,7 @@ func (b *Broker) sendSessionCreates(session *persistence.Session) {
 		return
 	}
 
-	fps, err := b.getActiveFingerprints(session.Id)
+	fps, err := b.getFingerprintsByApiSessionId(session.ApiSessionId)
 
 	if err != nil {
 		pfxlog.Logger().Errorf("could not obtain a fingerprint for the api session [%s] and session [%s]", session.ApiSessionId, session.Id)
@@ -484,6 +495,7 @@ func (b *Broker) sendSessionCreates(session *persistence.Session) {
 		Service:          svc,
 		CertFingerprints: fps,
 		Type:             sessionType,
+		ApiSessionId:     session.ApiSessionId,
 	})
 
 	if buf, err := proto.Marshal(sessionAdded); err == nil {
@@ -530,7 +542,7 @@ func (b *Broker) streamApiSessions(chunkSize int, callback func(addedMsg *edge_c
 			return nil
 		}
 
-		apiSessionProto, err := b.modelApiSessionToProto(apiSession.Token, apiSession.IdentityId)
+		apiSessionProto, err := b.modelApiSessionToProto(apiSession.Token, apiSession.IdentityId, apiSession.Id)
 
 		if err != nil {
 			logger.Errorf("error converting api session to proto: %v", err)
@@ -584,24 +596,37 @@ func (b *Broker) streamSessions(edgeRouterId string, chunkSize int, callback fun
 	})
 }
 
-func (b *Broker) getActiveFingerprints(sessionId string) ([]string, error) {
-	certs, err := b.ae.Handlers.Session.ReadSessionCerts(sessionId)
+func (b *Broker) getFingerprints(identityId, apiSessionId string) ([]string, error) {
+	identityPrints, err := b.getIdentityAuthenticatorFingerprints(identityId)
+
 	if err != nil {
 		return nil, err
 	}
-	var ret []string
 
-	now := time.Now()
-	for _, c := range certs {
-		if (now.Equal(c.ValidFrom) || now.After(c.ValidFrom)) && now.Before(c.ValidTo) {
-			ret = append(ret, c.Fingerprint)
-		}
+	apiSessionPrints, err := b.getApiSessionCertificateFingerprints(apiSessionId)
+
+	if err != nil {
+		return nil, err
 	}
 
-	return ret, nil
+	for _, apiSessionPrint := range apiSessionPrints {
+		identityPrints = append(identityPrints, apiSessionPrint)
+	}
+
+	return identityPrints, nil
 }
 
-func (b *Broker) getApiSessionFingerprints(identityId string) ([]string, error) {
+func (b *Broker) getFingerprintsByApiSessionId(apiSessionId string) ([]string, error) {
+	apiSession, err := b.ae.GetHandlers().ApiSession.Read(apiSessionId)
+
+	if err != nil {
+		return nil, fmt.Errorf("could not query fingerprints by api session id [%s]: %s", apiSessionId, err)
+	}
+
+	return b.getFingerprints(apiSession.IdentityId, apiSessionId)
+}
+
+func (b *Broker) getIdentityAuthenticatorFingerprints(identityId string) ([]string, error) {
 	fingerprintsMap := map[string]struct{}{}
 
 	err := b.ae.Handlers.Identity.CollectAuthenticators(identityId, func(authenticator *model.Authenticator) error {
@@ -623,8 +648,28 @@ func (b *Broker) getApiSessionFingerprints(identityId string) ([]string, error)
 	return fingerprints, nil
 }
 
-func (b *Broker) modelApiSessionToProto(token, identityId string) (*edge_ctrl_pb.ApiSession, error) {
-	fingerprints, err := b.getApiSessionFingerprints(identityId)
+func (b *Broker) getApiSessionCertificateFingerprints(apiSessionId string) ([]string, error) {
+	apiSessionCerts, err := b.ae.GetHandlers().ApiSessionCertificate.ReadByApiSessionId(apiSessionId)
+
+	if err != nil {
+		return nil, err
+	}
+
+	var validPrints []string
+
+	now := time.Now()
+	for _, apiSessionCert := range apiSessionCerts {
+		if apiSessionCert.ValidAfter != nil && now.After(*apiSessionCert.ValidAfter) &&
+			apiSessionCert.ValidBefore != nil && now.Before(*apiSessionCert.ValidBefore) {
+			validPrints = append(validPrints, apiSessionCert.Fingerprint)
+		}
+	}
+
+	return validPrints, nil
+}
+
+func (b *Broker) modelApiSessionToProto(token, identityId, apiSessionId string) (*edge_ctrl_pb.ApiSession, error) {
+	fingerprints, err := b.getFingerprints(identityId, apiSessionId)
 	if err != nil {
 		return nil, err
 	}
@@ -632,6 +677,7 @@ func (b *Broker) modelApiSessionToProto(token, identityId string) (*edge_ctrl_pb
 	return &edge_ctrl_pb.ApiSession{
 		Token:            token,
 		CertFingerprints: fingerprints,
+		Id:               apiSessionId,
 	}, nil
 }
 
@@ -641,7 +687,7 @@ func (b *Broker) modelSessionToProto(ns *model.Session) (*edge_ctrl_pb.Session,
 		return nil, fmt.Errorf("could not convert to session proto, could not find service: %s", err)
 	}
 
-	fps, err := b.getActiveFingerprints(ns.Id)
+	fps, err := b.getFingerprintsByApiSessionId(ns.ApiSessionId)
 
 	if err != nil {
 		return nil, fmt.Errorf("could not get fingerprints for network session: %s", err)
@@ -664,6 +710,7 @@ func (b *Broker) modelSessionToProto(ns *model.Session) (*edge_ctrl_pb.Session,
 		Service:          svc,
 		CertFingerprints: fps,
 		Type:             sessionType,
+		ApiSessionId:     ns.ApiSessionId,
 	}, nil
 }
 
@@ -751,3 +798,29 @@ func (b *Broker) RouterDisconnected(r *network.Router) {
 		}
 	}()
 }
+
+func (b *Broker) apiSessionCertificateEventHandler(args ...interface{}) {
+	var apiSessionCert *persistence.ApiSessionCertificate
+	if len(args) == 1 {
+		apiSessionCert, _ = args[0].(*persistence.ApiSessionCertificate)
+	}
+
+	if apiSessionCert == nil {
+		log := pfxlog.Logger()
+		log.Error("could not cast event args to event details: create/delete api session cert")
+		return
+	}
+	var apiSession *persistence.ApiSession
+	var err error
+	err = b.ae.GetDbProvider().GetDb().View(func(tx *bbolt.Tx) error {
+		apiSession, err = b.ae.GetStores().ApiSession.LoadOneById(tx, apiSessionCert.ApiSessionId)
+		return err
+	})
+
+	if err != nil {
+		pfxlog.Logger().WithError(err).Error("could not process API Session certificate creation. Failed to query for parent API Session")
+		return
+	}
+
+	b.sendApiSessionUpdates(apiSession)
+}

controller/internal/routes/current_api_session_api_model.go

@@ -17,8 +17,12 @@
 package routes
 
 import (
+	"fmt"
 	"github.com/go-openapi/strfmt"
+	"github.com/michaelquigley/pfxlog"
+	"github.com/openziti/edge/controller/env"
 	"github.com/openziti/edge/controller/model"
+	"github.com/openziti/edge/controller/response"
 	"github.com/openziti/edge/rest_model"
 	"github.com/openziti/fabric/controller/models"
 	"github.com/openziti/foundation/util/stringz"
@@ -26,6 +30,9 @@ import (
 )
 
 const EntityNameCurrentSession = "current-api-session"
+const EntityNameCurrentSessionCertificates = "certificates"
+
+var CurrentApiSessionCertificateLinkFactory *BasicLinkFactory = NewBasicLinkFactory(EntityNameCurrentSession + "/" + EntityNameCurrentSessionCertificates)
 
 var CurrentApiSessionLinkFactory LinksFactory = NewCurrentApiSessionLinkFactory()
 
@@ -65,3 +72,41 @@ func MapToCurrentApiSessionRestModel(s *model.ApiSession, sessionTimeout time.Du
 
 	return apiSession
 }
+
+func MapApiSessionCertificateToRestEntity(appEnv *env.AppEnv, context *response.RequestContext, e models.Entity) (interface{}, error) {
+	i, ok := e.(*model.ApiSessionCertificate)
+
+	if !ok {
+		err := fmt.Errorf("entity is not an API Session Certificate \"%s\"", e.GetId())
+		log := pfxlog.Logger()
+		log.Error(err)
+		return nil, err
+	}
+
+	al, err := MapApiSessionCertificateToRestModel(i)
+
+	if err != nil {
+		err := fmt.Errorf("could not convert to API entity \"%s\": %s", e.GetId(), err)
+		log := pfxlog.Logger()
+		log.Error(err)
+		return nil, err
+	}
+	return al, nil
+}
+
+func MapApiSessionCertificateToRestModel(apiSessionCert *model.ApiSessionCertificate) (*rest_model.CurrentAPISessionCertificateDetail, error) {
+
+	validFrom := strfmt.DateTime(*apiSessionCert.ValidAfter)
+	validTo := strfmt.DateTime(*apiSessionCert.ValidBefore)
+
+	ret := &rest_model.CurrentAPISessionCertificateDetail{
+		BaseEntity:  BaseEntityToRestModel(apiSessionCert, CurrentApiSessionCertificateLinkFactory),
+		Fingerprint: &apiSessionCert.Fingerprint,
+		Subject:     &apiSessionCert.Subject,
+		ValidFrom:   &validFrom,
+		ValidTo:     &validTo,
+		Certificate: &apiSessionCert.PEM,
+	}
+
+	return ret, nil
+}

controller/internal/routes/current_api_session_router.go

@@ -24,6 +24,7 @@ import (
 	"github.com/openziti/edge/rest_model"
 	"github.com/openziti/edge/rest_server/operations/current_api_session"
 	"net/http"
+	"time"
 )
 
 func init() {
@@ -46,6 +47,24 @@ func (router *CurrentSessionRouter) Register(ae *env.AppEnv) {
 	ae.Api.CurrentAPISessionDeleteCurrentAPISessionHandler = current_api_session.DeleteCurrentAPISessionHandlerFunc(func(params current_api_session.DeleteCurrentAPISessionParams, i interface{}) middleware.Responder {
 		return ae.IsAllowed(router.Delete, params.HTTPRequest, "", "", permissions.IsAuthenticated())
 	})
+
+	ae.Api.CurrentAPISessionListCurrentAPISessionCertificatesHandler = current_api_session.ListCurrentAPISessionCertificatesHandlerFunc(func(params current_api_session.ListCurrentAPISessionCertificatesParams, i interface{}) middleware.Responder {
+		return ae.IsAllowed(router.ListCertificates, params.HTTPRequest, "", "", permissions.IsAuthenticated())
+	})
+
+	ae.Api.CurrentAPISessionCreateCurrentAPISessionCertificateHandler = current_api_session.CreateCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.CreateCurrentAPISessionCertificateParams, i interface{}) middleware.Responder {
+		return ae.IsAllowed(func(ae *env.AppEnv, rc *response.RequestContext) {
+			router.CreateCertificate(ae, rc, params)
+		}, params.HTTPRequest, "", "", permissions.IsAuthenticated())
+	})
+
+	ae.Api.CurrentAPISessionDetailCurrentAPISessionCertificateHandler = current_api_session.DetailCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.DetailCurrentAPISessionCertificateParams, i interface{}) middleware.Responder {
+		return ae.IsAllowed(router.DetailCertificate, params.HTTPRequest, params.ID, "", permissions.IsAuthenticated())
+	})
+
+	ae.Api.CurrentAPISessionDeleteCurrentAPISessionCertificateHandler = current_api_session.DeleteCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.DeleteCurrentAPISessionCertificateParams, i interface{}) middleware.Responder {
+		return ae.IsAllowed(router.DeleteCertificate, params.HTTPRequest, params.ID, "", permissions.IsAuthenticated())
+	})
 }
 
 func (router *CurrentSessionRouter) Detail(ae *env.AppEnv, rc *response.RequestContext) {
@@ -63,3 +82,101 @@ func (router *CurrentSessionRouter) Delete(ae *env.AppEnv, rc *response.RequestC
 
 	rc.RespondWithEmptyOk()
 }
+
+func (router *CurrentSessionRouter) ListCertificates(ae *env.AppEnv, rc *response.RequestContext) {
+	ListWithEnvelopeFactory(rc, defaultToListEnvelope, func(rc *response.RequestContext, queryOptions *QueryOptions) (*QueryResult, error) {
+		query, err := queryOptions.getFullQuery(ae.GetStores().ApiSessionCertificate)
+		if err != nil {
+			return nil, err
+		}
+
+		result, err := ae.GetHandlers().ApiSessionCertificate.BasePreparedList(query)
+		if err != nil {
+			return nil, err
+		}
+
+		apiEntities, err := modelToApi(ae, rc, MapApiSessionCertificateToRestEntity, result.GetEntities())
+		if err != nil {
+			return nil, err
+		}
+
+		return NewQueryResult(apiEntities, result.GetMetaData()), nil
+	})
+}
+
+func (router *CurrentSessionRouter) CreateCertificate(ae *env.AppEnv, rc *response.RequestContext, params current_api_session.CreateCurrentAPISessionCertificateParams) {
+	responder := &ApiSessionCertificateCreateResponder{ae: ae, Responder: rc}
+	CreateWithResponder(rc, responder, CurrentApiSessionCertificateLinkFactory, func() (string, error) {
+		return ae.GetHandlers().ApiSessionCertificate.CreateFromCSR(rc.ApiSession.Id, 12*time.Hour, []byte(*params.Body.Csr))
+	})
+}
+
+func (router *CurrentSessionRouter) DetailCertificate(ae *env.AppEnv, rc *response.RequestContext) {
+	certId, _ := rc.GetEntityId()
+	cert, err := ae.GetHandlers().ApiSessionCertificate.Read(certId)
+
+	if err != nil {
+		rc.RespondWithError(err)
+		return
+	}
+
+	if cert.ApiSessionId != rc.ApiSession.Id {
+		rc.RespondWithNotFound()
+		return
+	}
+
+	entity, err := MapApiSessionCertificateToRestEntity(ae, rc, cert)
+
+	if err != nil {
+		rc.RespondWithError(err)
+		return
+	}
+
+	rc.RespondWithOk(entity, nil)
+}
+
+func (router *CurrentSessionRouter) DeleteCertificate(ae *env.AppEnv, rc *response.RequestContext) {
+	certId, _ := rc.GetEntityId()
+	cert, err := ae.GetHandlers().ApiSessionCertificate.Read(certId)
+
+	if err != nil {
+		rc.RespondWithError(err)
+		return
+	}
+
+	if cert.ApiSessionId != rc.ApiSession.Id {
+		rc.RespondWithNotFound()
+		return
+	}
+
+	if err := ae.GetHandlers().ApiSessionCertificate.Delete(certId); err != nil {
+		rc.RespondWithError(err)
+		return
+	}
+
+	rc.RespondWithEmptyOk()
+}
+
+type ApiSessionCertificateCreateResponder struct {
+	response.Responder
+	ae *env.AppEnv
+}
+
+func (nsr *ApiSessionCertificateCreateResponder) RespondWithCreatedId(id string, link rest_model.Link) {
+	sessionCert, _ := nsr.ae.GetHandlers().ApiSessionCertificate.Read(id)
+	certString := string(sessionCert.PEM)
+
+	newSessionEnvelope := &rest_model.CreateCurrentAPISessionCertificateEnvelope{
+		Data: &rest_model.CurrentAPISessionCertificateCreateResponse{
+			CreateLocation: rest_model.CreateLocation{
+				Links: CurrentApiSessionCertificateLinkFactory.Links(sessionCert),
+				ID:    sessionCert.Id,
+			},
+			Certificate: &certString,
+			Cas:         string(nsr.ae.Config.CaPems()),
+		},
+		Meta: &rest_model.Meta{},
+	}
+
+	nsr.Respond(newSessionEnvelope, http.StatusCreated)
+}

controller/model/api_session_certificate_handlers.go

@@ -0,0 +1,157 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package model
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"github.com/openziti/edge/controller/apierror"
+	"github.com/openziti/edge/internal/cert"
+	"github.com/openziti/fabric/controller/models"
+	"go.etcd.io/bbolt"
+	"time"
+)
+
+func NewApiSessionCertificateHandler(env Env) *ApiSessionCertificateHandler {
+	handler := &ApiSessionCertificateHandler{
+		baseHandler: newBaseHandler(env, env.GetStores().ApiSessionCertificate),
+	}
+	handler.impl = handler
+
+	return handler
+}
+
+type ApiSessionCertificateHandler struct {
+	baseHandler
+}
+
+func (handler *ApiSessionCertificateHandler) newModelEntity() boltEntitySink {
+	return &ApiSessionCertificate{}
+}
+
+func (handler *ApiSessionCertificateHandler) Create(entity *ApiSessionCertificate) (string, error) {
+	return handler.createEntity(entity)
+}
+
+func (handler *ApiSessionCertificateHandler) CreateFromCSR(apiSessionId string, lifespan time.Duration, csr []byte) (string, error) {
+	notBefore := time.Now()
+	notAfter := time.Now().Add(lifespan)
+
+	certRaw, err := handler.env.GetApiClientCsrSigner().Sign(csr, &cert.SigningOpts{
+		NotAfter:  &notAfter,
+		NotBefore: &notBefore,
+	})
+
+	if err != nil {
+		apiErr := apierror.NewCouldNotProcessCsr()
+		apiErr.Cause = err
+		apiErr.AppendCause = true
+		return "", apiErr
+	}
+
+	fp := handler.env.GetFingerprintGenerator().FromRaw(certRaw)
+
+	certPem := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: certRaw,
+	})
+
+	cert, _ := x509.ParseCertificate(certRaw)
+
+	entity := &ApiSessionCertificate{
+		BaseEntity:   models.BaseEntity{},
+		ApiSessionId: apiSessionId,
+		Subject:      cert.Subject.String(),
+		Fingerprint:  fp,
+		ValidAfter:   &notBefore,
+		ValidBefore:  &notAfter,
+		PEM:          string(certPem),
+	}
+
+	return handler.Create(entity)
+}
+
+func (handler *ApiSessionCertificateHandler) Read(id string) (*ApiSessionCertificate, error) {
+	modelApiSessionCertificate := &ApiSessionCertificate{}
+	if err := handler.readEntity(id, modelApiSessionCertificate); err != nil {
+		return nil, err
+	}
+	return modelApiSessionCertificate, nil
+}
+
+func (handler *ApiSessionCertificateHandler) ReadByFingerprint(fingerprint string) (*ApiSessionCertificate, error) {
+	modelApiSessionCertificate := &ApiSessionCertificate{}
+	tokenIndex := handler.env.GetStores().ApiSessionCertificate.GetFingerprintIndex()
+	if err := handler.readEntityWithIndex("fingerprint", []byte(fingerprint), tokenIndex, modelApiSessionCertificate); err != nil {
+		return nil, err
+	}
+	return modelApiSessionCertificate, nil
+}
+
+func (handler *ApiSessionCertificateHandler) readInTx(tx *bbolt.Tx, id string) (*ApiSessionCertificate, error) {
+	modelApiSessionCertificate := &ApiSessionCertificate{}
+	if err := handler.readEntityInTx(tx, id, modelApiSessionCertificate); err != nil {
+		return nil, err
+	}
+	return modelApiSessionCertificate, nil
+}
+
+func (handler *ApiSessionCertificateHandler) IsUpdated(_ string) bool {
+	return false
+}
+
+func (handler *ApiSessionCertificateHandler) Delete(id string) error {
+	return handler.deleteEntity(id)
+}
+
+func (handler *ApiSessionCertificateHandler) Query(query string) (*ApiSessionCertificateListResult, error) {
+	result := &ApiSessionCertificateListResult{handler: handler}
+	err := handler.list(query, result.collect)
+	if err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func (handler *ApiSessionCertificateHandler) ReadByApiSessionId(apiSessionId string) ([]*ApiSessionCertificate, error) {
+	result, err := handler.Query(fmt.Sprintf(`apiSession = "%s"`, apiSessionId))
+
+	if err != nil {
+		return nil, err
+	}
+
+	return result.ApiSessionCertificates, nil
+}
+
+type ApiSessionCertificateListResult struct {
+	handler                *ApiSessionCertificateHandler
+	ApiSessionCertificates []*ApiSessionCertificate
+	models.QueryMetaData
+}
+
+func (result *ApiSessionCertificateListResult) collect(tx *bbolt.Tx, ids []string, queryMetaData *models.QueryMetaData) error {
+	result.QueryMetaData = *queryMetaData
+	for _, key := range ids {
+		ApiSessionCertificate, err := result.handler.readInTx(tx, key)
+		if err != nil {
+			return err
+		}
+		result.ApiSessionCertificates = append(result.ApiSessionCertificates, ApiSessionCertificate)
+	}
+	return nil
+}

controller/model/api_session_certificate_model.go

@@ -0,0 +1,95 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package model
+
+import (
+	"github.com/openziti/edge/controller/persistence"
+	"github.com/openziti/fabric/controller/models"
+	"github.com/openziti/foundation/storage/boltz"
+	"github.com/openziti/foundation/validation"
+	"github.com/pkg/errors"
+	"go.etcd.io/bbolt"
+	"reflect"
+	"time"
+)
+
+type ApiSessionCertificate struct {
+	models.BaseEntity
+	ApiSession   *ApiSession
+	ApiSessionId string
+	Subject      string
+	Fingerprint  string
+	ValidAfter   *time.Time
+	ValidBefore  *time.Time
+	PEM          string
+}
+
+func (entity *ApiSessionCertificate) toBoltEntity(tx *bbolt.Tx, handler Handler) (boltz.Entity, error) {
+	if !handler.GetEnv().GetStores().ApiSession.IsEntityPresent(tx, entity.ApiSessionId) {
+		return nil, validation.NewFieldError("api session not found", "ApiSessionId", entity.ApiSessionId)
+	}
+
+	boltEntity := &persistence.ApiSessionCertificate{
+		BaseExtEntity: *boltz.NewExtEntity(entity.Id, entity.Tags),
+		ApiSessionId:  entity.ApiSessionId,
+		Subject:       entity.Subject,
+		Fingerprint:   entity.Fingerprint,
+		ValidAfter:    entity.ValidAfter,
+		ValidBefore:   entity.ValidBefore,
+		PEM:           entity.PEM,
+	}
+
+	return boltEntity, nil
+}
+
+func (entity *ApiSessionCertificate) toBoltEntityForCreate(tx *bbolt.Tx, handler Handler) (boltz.Entity, error) {
+	return entity.toBoltEntity(tx, handler)
+}
+
+func (entity *ApiSessionCertificate) toBoltEntityForUpdate(tx *bbolt.Tx, handler Handler) (boltz.Entity, error) {
+	return entity.toBoltEntity(tx, handler)
+}
+
+func (entity *ApiSessionCertificate) toBoltEntityForPatch(tx *bbolt.Tx, handler Handler) (boltz.Entity, error) {
+	return entity.toBoltEntity(tx, handler)
+}
+
+func (entity *ApiSessionCertificate) fillFrom(handler Handler, tx *bbolt.Tx, boltEntity boltz.Entity) error {
+	boltApiSessionCertificate, ok := boltEntity.(*persistence.ApiSessionCertificate)
+	if !ok {
+		return errors.Errorf("unexpected type %v when filling model ApiSessionCertificate", reflect.TypeOf(boltEntity))
+	}
+
+	entity.FillCommon(boltApiSessionCertificate)
+	entity.Subject = boltApiSessionCertificate.Subject
+	entity.Fingerprint = boltApiSessionCertificate.Fingerprint
+	entity.ValidAfter = boltApiSessionCertificate.ValidAfter
+	entity.ValidBefore = boltApiSessionCertificate.ValidBefore
+	entity.PEM = boltApiSessionCertificate.PEM
+	entity.ApiSessionId = boltApiSessionCertificate.ApiSessionId
+
+	boltApiSession, err := handler.GetEnv().GetStores().ApiSession.LoadOneById(tx, boltApiSessionCertificate.ApiSessionId)
+	if err != nil {
+		return err
+	}
+	modelApiSession := &ApiSession{}
+	if err := modelApiSession.fillFrom(handler, tx, boltApiSession); err != nil {
+		return err
+	}
+	entity.ApiSession = modelApiSession
+	return nil
+}

controller/model/env.go

@@ -40,6 +40,7 @@ type Env interface {
 	GetHostController() HostController
 	IsEdgeRouterOnline(id string) bool
 	GetMetricsRegistry() metrics.Registry
+	GetFingerprintGenerator() cert.FingerprintGenerator
 }
 
 type HostController interface {

controller/model/handlers.go

@@ -28,6 +28,7 @@ type Handlers struct {
 
 	// edge
 	ApiSession              *ApiSessionHandler
+	ApiSessionCertificate   *ApiSessionCertificateHandler
 	Ca                      *CaHandler
 	Config                  *ConfigHandler
 	ConfigType              *ConfigTypeHandler
@@ -58,6 +59,7 @@ func InitHandlers(env Env) *Handlers {
 	handlers.Terminator = env.GetDbProvider().GetControllers().Terminators
 
 	handlers.ApiSession = NewApiSessionHandler(env)
+	handlers.ApiSessionCertificate = NewApiSessionCertificateHandler(env)
 	handlers.Authenticator = NewAuthenticatorHandler(env)
 	handlers.Ca = NewCaHandler(env)
 	handlers.Config = NewConfigHandler(env)

controller/model/testing.go

@@ -86,6 +86,10 @@ func (ctx *TestContext) GetMetricsRegistry() metrics.Registry {
 	return ctx.metricsRegistry
 }
 
+func (ctx *TestContext) GetFingerprintGenerator() cert.FingerprintGenerator {
+	return nil
+}
+
 func newTestContext(t *testing.T) *TestContext {
 	context := &TestContext{
 		TestContext:     persistence.NewTestContext(t),

controller/persistence/api_session_certificate_store.go

@@ -0,0 +1,142 @@
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package persistence
+
+import (
+	"github.com/openziti/edge/eid"
+	"github.com/openziti/foundation/storage/ast"
+	"github.com/openziti/foundation/storage/boltz"
+	"go.etcd.io/bbolt"
+	"time"
+)
+
+const (
+	FieldApiSessionCertificateApiSession  = "apiSession"
+	FieldApiSessionCertificateSubject     = "subject"
+	FieldApiSessionCertificateFingerprint = "fingerprint"
+	FieldApiSessionCertificateValidAfter  = "validAfter"
+	FieldApiSessionCertificateValidBefore = "validBefore"
+	FieldApiSessionCertificatePem         = "pem"
+)
+
+type ApiSessionCertificate struct {
+	boltz.BaseExtEntity
+	ApiSessionId string
+	Subject      string
+	Fingerprint  string
+	ValidAfter   *time.Time
+	ValidBefore  *time.Time
+	PEM          string
+}
+
+func NewApiSessionCertificate(apiSessionId string) *ApiSessionCertificate {
+	return &ApiSessionCertificate{
+		BaseExtEntity: boltz.BaseExtEntity{Id: eid.New()},
+		ApiSessionId:  apiSessionId,
+		Subject:       eid.New(),
+	}
+}
+
+func (entity *ApiSessionCertificate) LoadValues(_ boltz.CrudStore, bucket *boltz.TypedBucket) {
+	entity.LoadBaseValues(bucket)
+	entity.ApiSessionId = bucket.GetStringOrError(FieldApiSessionCertificateApiSession)
+	entity.Subject = bucket.GetStringOrError(FieldApiSessionCertificateSubject)
+	entity.Fingerprint = bucket.GetStringOrError(FieldApiSessionCertificateFingerprint)
+	entity.ValidAfter = bucket.GetTime(FieldApiSessionCertificateValidAfter)
+	entity.ValidBefore = bucket.GetTime(FieldApiSessionCertificateValidBefore)
+	entity.PEM = bucket.GetStringOrError((FieldApiSessionCertificatePem))
+}
+
+func (entity *ApiSessionCertificate) SetValues(ctx *boltz.PersistContext) {
+	entity.SetBaseValues(ctx)
+	ctx.SetString(FieldApiSessionCertificateApiSession, entity.ApiSessionId)
+	ctx.SetString(FieldApiSessionCertificateSubject, entity.Subject)
+	ctx.SetString(FieldApiSessionCertificateFingerprint, entity.Fingerprint)
+	ctx.SetTimeP(FieldApiSessionCertificateValidAfter, entity.ValidAfter)
+	ctx.SetTimeP(FieldApiSessionCertificateValidBefore, entity.ValidBefore)
+	ctx.SetString(FieldApiSessionCertificatePem, entity.PEM)
+}
+
+func (entity *ApiSessionCertificate) GetEntityType() string {
+	return EntityTypeApiSessionCertificates
+}
+
+type ApiSessionCertificateStore interface {
+	Store
+	LoadOneById(tx *bbolt.Tx, id string) (*ApiSessionCertificate, error)
+	LoadOneByFingerprint(tx *bbolt.Tx, token string) (*ApiSessionCertificate, error)
+	LoadOneByQuery(tx *bbolt.Tx, query string) (*ApiSessionCertificate, error)
+	GetFingerprintIndex() boltz.ReadIndex
+}
+
+func newApiSessionCertificateStore(stores *stores) *ApiSessionCertificateStoreImpl {
+	store := &ApiSessionCertificateStoreImpl{
+		baseStore: newBaseStore(stores, EntityTypeApiSessionCertificates),
+	}
+	store.InitImpl(store)
+	return store
+}
+
+type ApiSessionCertificateStoreImpl struct {
+	*baseStore
+	indexToken       boltz.ReadIndex
+	symbolApiSession boltz.EntitySymbol
+}
+
+func (store *ApiSessionCertificateStoreImpl) NewStoreEntity() boltz.Entity {
+	return &ApiSessionCertificate{}
+}
+
+func (store *ApiSessionCertificateStoreImpl) GetFingerprintIndex() boltz.ReadIndex {
+	return store.indexToken
+}
+
+func (store *ApiSessionCertificateStoreImpl) initializeLocal() {
+	store.AddExtEntitySymbols()
+	symbolToken := store.AddSymbol(FieldApiSessionCertificateFingerprint, ast.NodeTypeString)
+	store.indexToken = store.AddUniqueIndex(symbolToken)
+	store.symbolApiSession = store.AddFkSymbol(FieldApiSessionCertificateApiSession, store.stores.apiSession)
+
+	store.AddFkConstraint(store.symbolApiSession, false, boltz.CascadeDelete)
+}
+
+func (store *ApiSessionCertificateStoreImpl) initializeLinked() {
+}
+
+func (store *ApiSessionCertificateStoreImpl) LoadOneById(tx *bbolt.Tx, id string) (*ApiSessionCertificate, error) {
+	entity := &ApiSessionCertificate{}
+	if err := store.baseLoadOneById(tx, id, entity); err != nil {
+		return nil, err
+	}
+	return entity, nil
+}
+
+func (store *ApiSessionCertificateStoreImpl) LoadOneByFingerprint(tx *bbolt.Tx, fingerprint string) (*ApiSessionCertificate, error) {
+	id := store.indexToken.Read(tx, []byte(fingerprint))
+	if id != nil {
+		return store.LoadOneById(tx, string(id))
+	}
+	return nil, boltz.NewNotFoundError(store.GetSingularEntityType(), "fingerprint", fingerprint)
+}
+
+func (store *ApiSessionCertificateStoreImpl) LoadOneByQuery(tx *bbolt.Tx, query string) (*ApiSessionCertificate, error) {
+	entity := &ApiSessionCertificate{}
+	if found, err := store.BaseLoadOneByQuery(tx, query, entity); !found || err != nil {
+		return nil, err
+	}
+	return entity, nil
+}

controller/persistence/base_entity.go

@@ -23,6 +23,7 @@ import (
 
 const (
 	EntityTypeApiSessions               = "apiSessions"
+	EntityTypeApiSessionCertificates    = "apiSessionCertificates"
 	EntityTypeCas                       = "cas"
 	EntityTypeConfigs                   = "configs"
 	EntityTypeConfigTypes               = "configTypes"

controller/persistence/stores.go

@@ -36,6 +36,7 @@ type Stores struct {
 	Terminator db.TerminatorStore
 
 	ApiSession              ApiSessionStore
+	ApiSessionCertificate   ApiSessionCertificateStore
 	Ca                      CaStore
 	Config                  ConfigStore
 	ConfigType              ConfigTypeStore
@@ -141,6 +142,7 @@ type stores struct {
 	authenticator           *authenticatorStoreImpl
 	postureCheck            *postureCheckStoreImpl
 	postureCheckType        *postureCheckTypeStoreImpl
+	apiSessionCertificate   *ApiSessionCertificateStoreImpl
 }
 
 func NewBoltStores(dbProvider DbProvider) (*Stores, error) {
@@ -155,6 +157,7 @@ func NewBoltStores(dbProvider DbProvider) (*Stores, error) {
 	internalStores.Service = dbProvider.GetStores().Service
 
 	internalStores.apiSession = newApiSessionStore(internalStores)
+	internalStores.apiSessionCertificate = newApiSessionCertificateStore(internalStores)
 	internalStores.authenticator = newAuthenticatorStore(internalStores)
 	internalStores.ca = newCaStore(internalStores)
 	internalStores.config = newConfigsStore(internalStores)
@@ -182,6 +185,7 @@ func NewBoltStores(dbProvider DbProvider) (*Stores, error) {
 		Service:    dbProvider.GetStores().Service,
 
 		ApiSession:              internalStores.apiSession,
+		ApiSessionCertificate:   internalStores.apiSessionCertificate,
 		Ca:                      internalStores.ca,
 		Config:                  internalStores.config,
 		ConfigType:              internalStores.configType,

internal/cert/cert.go

@@ -50,6 +50,9 @@ type SigningOpts struct {
 	EmailAddresses []string
 	IPAddresses    []net.IP
 	URIs           []*url.URL
+
+	NotBefore *time.Time
+	NotAfter  *time.Time
 }
 
 func (so *SigningOpts) Apply(c *x509.Certificate) {
@@ -57,6 +60,14 @@ func (so *SigningOpts) Apply(c *x509.Certificate) {
 	c.EmailAddresses = so.EmailAddresses
 	c.IPAddresses = so.IPAddresses
 	c.URIs = so.URIs
+
+	if so.NotBefore != nil {
+		c.NotBefore = *so.NotBefore
+	}
+
+	if so.NotAfter != nil {
+		c.NotAfter = *so.NotAfter
+	}
 }
 
 type SerialGenerator interface {

pb/edge_ctrl_pb/README.md

@@ -12,8 +12,8 @@ Two options, run the command manually or use `go generate`
 
 ## Go Generate
 
-1. Navigate to the root project
-2. run `go generate edge/pb/edge_ctrl_pb/...`
+1. Navigate to the root project directory `edge`
+2. run `go generate ./pb/edge_ctrl_pb/...` or  `go generate .\pb\edge_ctrl_pb\...`
 
 Note: Running a naked `go generate` will trigger all `go:generate` tags in the project, which you most likely do not want
 

pb/edge_ctrl_pb/edge_ctrl.pb.go

@@ -448,6 +448,7 @@ type Session struct {
 	Urls                 []string    `protobuf:"bytes,4,rep,name=urls,proto3" json:"urls,omitempty"`
 	Service              *Service    `protobuf:"bytes,5,opt,name=service,proto3" json:"service,omitempty"`
 	Id                   string      `protobuf:"bytes,7,opt,name=id,proto3" json:"id,omitempty"`
+	ApiSessionId         string      `protobuf:"bytes,8,opt,name=apiSessionId,proto3" json:"apiSessionId,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}    `json:"-"`
 	XXX_unrecognized     []byte      `json:"-"`
 	XXX_sizecache        int32       `json:"-"`
@@ -520,9 +521,17 @@ func (m *Session) GetId() string {
 	return ""
 }
 
+func (m *Session) GetApiSessionId() string {
+	if m != nil {
+		return m.ApiSessionId
+	}
+	return ""
+}
+
 type ApiSession struct {
 	Token                string   `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
 	CertFingerprints     []string `protobuf:"bytes,2,rep,name=certFingerprints,proto3" json:"certFingerprints,omitempty"`
+	Id                   string   `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -567,6 +576,13 @@ func (m *ApiSession) GetCertFingerprints() []string {
 	return nil
 }
 
+func (m *ApiSession) GetId() string {
+	if m != nil {
+		return m.Id
+	}
+	return ""
+}
+
 type ApiSessionAdded struct {
 	IsFullState          bool          `protobuf:"varint,1,opt,name=isFullState,proto3" json:"isFullState,omitempty"`
 	ApiSessions          []*ApiSession `protobuf:"bytes,2,rep,name=apiSessions,proto3" json:"apiSessions,omitempty"`
@@ -1477,88 +1493,89 @@ func init() {
 }
 
 var fileDescriptor_23f46a161f139ee1 = []byte{
-	// 1324 bytes of a gzipped FileDescriptorProto
+	// 1342 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x57, 0xdd, 0x6e, 0xdb, 0xc6,
-	0x12, 0x16, 0x29, 0xc9, 0xb2, 0x46, 0x8e, 0xcd, 0xec, 0x91, 0x73, 0x18, 0xe5, 0x1c, 0x1f, 0x1f,
-	0x06, 0x28, 0x04, 0x27, 0x56, 0x11, 0x05, 0x45, 0x82, 0x34, 0x48, 0xa1, 0xc8, 0x72, 0x65, 0x24,
-	0x96, 0x1c, 0xca, 0x86, 0x91, 0x02, 0x85, 0xb1, 0x26, 0x17, 0x36, 0x61, 0x8a, 0xcb, 0xee, 0xae,
-	0xdc, 0xea, 0xbe, 0x2d, 0xfa, 0x0a, 0x05, 0xe2, 0xa0, 0xed, 0x5d, 0x81, 0xbe, 0x43, 0x5f, 0xa0,
-	0x45, 0x2f, 0x7a, 0xdd, 0xfb, 0xfe, 0xbc, 0x44, 0xb1, 0x4b, 0x52, 0xa2, 0x2c, 0x45, 0x4d, 0x80,
-	0xdc, 0xed, 0xce, 0xcf, 0xc7, 0x9d, 0xd9, 0x6f, 0x67, 0x86, 0xb0, 0x42, 0xdc, 0x13, 0x72, 0xe4,
-	0x08, 0xe6, 0xd7, 0x42, 0x46, 0x05, 0x45, 0x4b, 0x29, 0xc1, 0xb1, 0xf5, 0xb5, 0x06, 0xa5, 0x1e,
-	0x61, 0xe7, 0x84, 0xb5, 0x89, 0xef, 0x53, 0x64, 0x42, 0xe1, 0x9c, 0x30, 0xee, 0xd1, 0xc0, 0xd4,
-	0xd6, 0xb5, 0x6a, 0xd1, 0x4e, 0xb6, 0xe8, 0x1e, 0xe4, 0x5c, 0x2c, 0xb0, 0xa9, 0xaf, 0x67, 0xab,
-	0xa5, 0xfa, 0xcd, 0x5a, 0x1a, 0xa6, 0x96, 0x82, 0xa8, 0x6d, 0x61, 0x81, 0x5b, 0x81, 0x60, 0x43,
-	0x5b, 0x39, 0x54, 0xee, 0x41, 0x71, 0x24, 0x42, 0x06, 0x64, 0xcf, 0xc8, 0x30, 0xc6, 0x96, 0x4b,
-	0x54, 0x86, 0xfc, 0x39, 0xf6, 0x07, 0xc4, 0xd4, 0x95, 0x2c, 0xda, 0x3c, 0xd0, 0xef, 0x6b, 0xd6,
-	0xaf, 0x1a, 0x94, 0x9a, 0xbe, 0x47, 0x02, 0xf1, 0x4f, 0x67, 0xab, 0xc0, 0xe2, 0x29, 0xe5, 0x22,
-	0xc0, 0xfd, 0x04, 0x66, 0xb4, 0x47, 0xff, 0x81, 0xa2, 0x0a, 0xdc, 0xa1, 0x3e, 0x37, 0xb3, 0xeb,
-	0xd9, 0x6a, 0xd1, 0x1e, 0x0b, 0x46, 0x51, 0xe5, 0x66, 0x45, 0x95, 0xfa, 0xf8, 0xdb, 0x8b, 0xea,
-	0x09, 0xe4, 0x5b, 0x8c, 0x51, 0x86, 0x10, 0xe4, 0x1c, 0xea, 0x92, 0xd8, 0x4b, 0xad, 0x65, 0x88,
-	0x7d, 0xc2, 0x39, 0x3e, 0x49, 0x1c, 0x93, 0xad, 0x04, 0x74, 0xf0, 0x80, 0x13, 0x33, 0x1b, 0x01,
-	0xaa, 0x8d, 0xf5, 0x31, 0x14, 0x64, 0xea, 0x3d, 0x87, 0xa0, 0x65, 0xd0, 0x3d, 0x37, 0x06, 0xd3,
-	0x3d, 0x57, 0xc2, 0xa7, 0xf2, 0xa1, 0xd6, 0xa8, 0x06, 0x88, 0x04, 0x0e, 0x1b, 0x86, 0xc2, 0xa3,
-	0x81, 0x4d, 0x3e, 0x19, 0x78, 0x8c, 0xb8, 0x0a, 0x71, 0xd1, 0x9e, 0xa1, 0xb1, 0x7e, 0xd1, 0x24,
-	0x3e, 0x57, 0x39, 0x2e, 0x43, 0x5e, 0xd0, 0x33, 0x92, 0xe4, 0x3e, 0xda, 0xa0, 0x4d, 0xc8, 0x89,
-	0x61, 0x18, 0x7d, 0x65, 0xb9, 0x7e, 0xfd, 0x32, 0x2b, 0x94, 0xeb, 0xfe, 0x30, 0x24, 0xb6, 0x32,
-	0x43, 0x1b, 0x60, 0x38, 0x84, 0x89, 0x6d, 0x2f, 0x38, 0x21, 0x2c, 0x64, 0x5e, 0x20, 0x92, 0x3b,
-	0x99, 0x92, 0xcb, 0x00, 0x06, 0xcc, 0xe7, 0xea, 0x6a, 0x8a, 0xb6, 0x5a, 0xa3, 0x77, 0xa1, 0xc0,
-	0xa3, 0x78, 0xcd, 0xfc, 0xba, 0x56, 0x2d, 0xd5, 0x57, 0xa7, 0x79, 0xe8, 0x39, 0xc4, 0x4e, 0xac,
-	0xe2, 0xac, 0x14, 0x92, 0xac, 0x58, 0x1d, 0x80, 0x46, 0xe8, 0xcd, 0x8f, 0x69, 0xd6, 0x21, 0xf5,
-	0xd9, 0x87, 0xb4, 0x28, 0xac, 0x8c, 0xf1, 0x1a, 0xae, 0x4b, 0x5c, 0xb4, 0x0e, 0x25, 0x8f, 0x6f,
-	0x0f, 0x7c, 0xbf, 0x27, 0xb0, 0x88, 0xae, 0x77, 0xd1, 0x4e, 0x8b, 0xd0, 0x03, 0x28, 0xe1, 0x91,
-	0x13, 0x8f, 0x5f, 0x94, 0x39, 0x19, 0xc9, 0x18, 0xd5, 0x4e, 0x1b, 0x5b, 0x5d, 0xb8, 0x3a, 0x56,
-	0x1d, 0x84, 0x2e, 0x16, 0xc4, 0xbd, 0x0c, 0xa8, 0xbd, 0x09, 0xe0, 0xad, 0x34, 0xa0, 0x4d, 0xfa,
-	0xf4, 0x9c, 0xb8, 0xe8, 0x1a, 0x2c, 0xa8, 0x5c, 0x44, 0x58, 0x45, 0x3b, 0xde, 0x59, 0x9b, 0xf0,
-	0xaf, 0xb1, 0x71, 0x9b, 0x60, 0x26, 0x8e, 0x09, 0x16, 0xaf, 0x34, 0x77, 0x60, 0xe9, 0x0d, 0x53,
-	0x73, 0x07, 0x16, 0xf9, 0x64, 0x5e, 0x56, 0x67, 0x72, 0xca, 0x1e, 0x99, 0x59, 0x55, 0x58, 0x7e,
-	0xcd, 0xd3, 0x9f, 0x8d, 0x2c, 0x93, 0xc4, 0xcd, 0x26, 0x40, 0xc2, 0x3c, 0x7d, 0x36, 0xf3, 0xb2,
-	0xaf, 0xc3, 0x3c, 0xeb, 0xab, 0x1c, 0x2c, 0xed, 0x51, 0x2e, 0x06, 0x8c, 0x3c, 0x1b, 0x10, 0x36,
-	0x9c, 0x7a, 0xa0, 0xef, 0xc0, 0x72, 0x18, 0xe9, 0x9b, 0xa7, 0xc4, 0x39, 0xdb, 0x71, 0xcd, 0xb2,
-	0xd2, 0x5d, 0x92, 0xca, 0xa4, 0xb9, 0x1e, 0x0f, 0x7d, 0x3c, 0xec, 0xc8, 0xf7, 0xbc, 0xa6, 0x8c,
-	0xd2, 0x22, 0x74, 0x37, 0x7e, 0x84, 0x55, 0xf5, 0x08, 0xff, 0x37, 0x79, 0xb0, 0xf4, 0x19, 0x6a,
-	0xa9, 0xa7, 0x98, 0xaa, 0xa6, 0xf5, 0xc9, 0x6a, 0x7a, 0x07, 0xf4, 0x00, 0x9b, 0x0f, 0x55, 0x94,
-	0xf3, 0xc0, 0x3a, 0x34, 0x20, 0xed, 0x8c, 0xad, 0x07, 0x18, 0x3d, 0x82, 0x42, 0xc8, 0xa8, 0x43,
-	0x38, 0x37, 0xb7, 0x95, 0x9f, 0x35, 0xc7, 0x6f, 0x2f, 0xb2, 0x6c, 0x67, 0xec, 0xc4, 0xa9, 0xb2,
-	0x00, 0x39, 0x89, 0x56, 0xa1, 0x50, 0x88, 0xb5, 0xf2, 0x6a, 0x42, 0x2c, 0x4e, 0x93, 0x3b, 0x8c,
-	0x36, 0xa8, 0x03, 0x57, 0x4e, 0x31, 0x3f, 0x6d, 0xf8, 0x27, 0x94, 0x79, 0xe2, 0xb4, 0x6f, 0x82,
-	0x8a, 0xb9, 0x3a, 0xe7, 0x73, 0xed, 0xb4, 0xbd, 0x3d, 0xe9, 0x6e, 0xdd, 0x87, 0x9c, 0xcc, 0x09,
-	0x5a, 0x00, 0xbd, 0xdb, 0x33, 0x32, 0xa8, 0x00, 0xd9, 0xdd, 0x46, 0xd3, 0x00, 0x84, 0x60, 0xf9,
-	0x70, 0xa7, 0xb3, 0xd5, 0x3d, 0xec, 0x1d, 0x6d, 0x75, 0x77, 0x1b, 0x3b, 0x1d, 0xa3, 0x8c, 0x4a,
-	0x50, 0xd8, 0xb3, 0xbb, 0xcd, 0x56, 0xaf, 0x67, 0xac, 0x59, 0x37, 0xe0, 0xca, 0x04, 0x32, 0x02,
-	0x58, 0xe8, 0xb5, 0x1b, 0xef, 0xdd, 0xa9, 0x1b, 0x99, 0xc7, 0x4b, 0x00, 0x21, 0x66, 0xb8, 0x4f,
-	0x04, 0x61, 0xdc, 0xfa, 0x7e, 0x11, 0x56, 0xe2, 0x23, 0xd9, 0x84, 0x87, 0x34, 0xe0, 0xd3, 0xe5,
-	0xfa, 0x7d, 0xc8, 0x13, 0xd9, 0x16, 0x14, 0x09, 0xa6, 0x3a, 0xd1, 0x25, 0xef, 0x9a, 0xea, 0x20,
-	0xed, 0x8c, 0x1d, 0xf9, 0xa4, 0xd3, 0xbf, 0x36, 0x27, 0xfd, 0x23, 0x77, 0x99, 0xe3, 0x54, 0xfa,
-	0xd1, 0x23, 0xc8, 0xf6, 0xb1, 0xa3, 0xf8, 0x53, 0xaa, 0x6f, 0xcc, 0xf7, 0xdd, 0xc5, 0x4e, 0xc3,
-	0x75, 0x19, 0xe1, 0x9c, 0xc8, 0x2b, 0x94, 0x8e, 0xa8, 0x05, 0x0b, 0x2e, 0xed, 0x63, 0x2f, 0xa2,
-	0x52, 0xa9, 0x7e, 0x6b, 0x3e, 0xc4, 0xa1, 0x17, 0xb8, 0xf4, 0x53, 0xbe, 0xa5, 0x5c, 0xda, 0x19,
-	0x3b, 0x76, 0x46, 0x1f, 0x80, 0x4e, 0x79, 0x4c, 0xbc, 0xcd, 0xf9, 0x10, 0xdd, 0x90, 0x30, 0x2c,
-	0xbc, 0xe0, 0xa4, 0x37, 0xe4, 0x82, 0xf4, 0x25, 0x0d, 0x29, 0xaf, 0xfc, 0xa0, 0x27, 0xcd, 0xf5,
-	0x61, 0xaa, 0xb9, 0xbe, 0x8a, 0x1e, 0x93, 0xd9, 0xac, 0x35, 0xa9, 0x4b, 0xa6, 0xdb, 0x30, 0x4c,
-	0xb6, 0xe1, 0x46, 0x3c, 0x2f, 0x94, 0x55, 0x6d, 0xda, 0x7c, 0x1d, 0xdc, 0xb7, 0x36, 0x39, 0x74,
-	0x21, 0x27, 0xcf, 0x28, 0x69, 0x78, 0xd0, 0x79, 0xd2, 0xe9, 0x1e, 0x76, 0x8c, 0x0c, 0xaa, 0xc0,
-	0xb5, 0x83, 0x4e, 0xef, 0x60, 0x6f, 0xaf, 0x6b, 0xef, 0xb7, 0xb6, 0x8e, 0x9e, 0x1d, 0xb4, 0xec,
-	0xe7, 0x47, 0xfb, 0xcf, 0xf7, 0x5a, 0x06, 0xa0, 0x35, 0xa8, 0xa4, 0x75, 0xed, 0x46, 0xaf, 0x7d,
-	0xd4, 0x78, 0xfa, 0x61, 0xd7, 0xde, 0xd9, 0x6f, 0xef, 0x1a, 0xe5, 0xca, 0x3e, 0xe4, 0x24, 0x13,
-	0xd0, 0x1a, 0xc0, 0xb1, 0x17, 0x60, 0x36, 0x94, 0x84, 0x8e, 0xcf, 0x92, 0x92, 0xa0, 0xdb, 0x70,
-	0x95, 0x7b, 0x27, 0x01, 0x61, 0xa9, 0xd6, 0x17, 0x27, 0x66, 0x5a, 0x51, 0xb9, 0x0d, 0x4b, 0x69,
-	0x8e, 0xc8, 0x01, 0x0c, 0x27, 0x9b, 0xf8, 0x31, 0x8f, 0x05, 0x95, 0x9b, 0x70, 0x65, 0x82, 0x0e,
-	0xa3, 0xb9, 0x45, 0x1b, 0xcf, 0x2d, 0x95, 0xdf, 0x34, 0x58, 0xb9, 0x74, 0xe3, 0x68, 0x3b, 0x2e,
-	0x7a, 0xd1, 0x0d, 0xd7, 0xdf, 0x88, 0x2e, 0xaf, 0xa8, 0x83, 0x30, 0x59, 0x07, 0xcb, 0x90, 0x3f,
-	0x1e, 0x78, 0x7e, 0x52, 0x97, 0xa3, 0x8d, 0x65, 0xc7, 0x15, 0xa3, 0x04, 0x85, 0x46, 0xe0, 0x32,
-	0xea, 0xb9, 0x51, 0xd9, 0xf0, 0xba, 0x3d, 0x03, 0x50, 0x11, 0xf2, 0x4f, 0xbd, 0x60, 0xf0, 0x99,
-	0x51, 0x96, 0xcb, 0x3e, 0x76, 0xba, 0x3d, 0x63, 0x4d, 0xda, 0xc6, 0x41, 0x1a, 0x55, 0x74, 0x75,
-	0x14, 0x71, 0x34, 0x35, 0x1b, 0xf5, 0xc7, 0x45, 0x28, 0x84, 0x78, 0xe8, 0x53, 0xec, 0x6e, 0xfc,
-	0xa8, 0x43, 0xa9, 0x49, 0x03, 0x41, 0x02, 0xa1, 0x3e, 0xb3, 0x08, 0xb9, 0x8f, 0x08, 0xa3, 0x46,
-	0x06, 0xad, 0xc2, 0x4a, 0x6a, 0xcc, 0x96, 0x4a, 0xe3, 0x9b, 0x17, 0x9a, 0x14, 0xa7, 0xe6, 0x54,
-	0x25, 0xfe, 0xf6, 0x85, 0x86, 0x56, 0xa0, 0xa8, 0xe8, 0xa7, 0x04, 0xdf, 0xbd, 0xd0, 0xd0, 0x35,
-	0x30, 0xd2, 0xbd, 0x58, 0xc9, 0x3f, 0xbf, 0xd0, 0x90, 0x09, 0x68, 0xb2, 0x29, 0x2a, 0xcd, 0x17,
-	0x13, 0x9a, 0xb8, 0xb1, 0x2a, 0xcd, 0x97, 0x17, 0x1a, 0xba, 0x9e, 0x1e, 0x03, 0xc6, 0x70, 0xbf,
-	0x5f, 0x68, 0xe8, 0x06, 0xac, 0x4e, 0xcd, 0x27, 0x4a, 0xf9, 0xc7, 0x65, 0x65, 0x1a, 0xf4, 0xcf,
-	0x0b, 0x0d, 0xfd, 0x17, 0xfe, 0x3d, 0x63, 0xb6, 0x50, 0xea, 0xbf, 0x2e, 0x34, 0x64, 0x00, 0xb4,
-	0x02, 0x46, 0x7d, 0x5f, 0x49, 0x7e, 0x7a, 0xa9, 0x22, 0x8f, 0x24, 0x4d, 0xc2, 0x04, 0x57, 0xe2,
-	0x9f, 0x5f, 0x6a, 0x1b, 0xff, 0x97, 0x7f, 0x34, 0xa3, 0xc1, 0x53, 0x26, 0x70, 0xcb, 0xc3, 0xbe,
-	0x91, 0x91, 0xab, 0xc7, 0x5e, 0xe0, 0x1a, 0xda, 0xf1, 0x82, 0xfa, 0x01, 0xb8, 0xfb, 0x77, 0x00,
-	0x00, 0x00, 0xff, 0xff, 0x16, 0xe2, 0x8d, 0x36, 0x1d, 0x0d, 0x00, 0x00,
+	0x12, 0x16, 0xf5, 0x63, 0x49, 0x23, 0xc7, 0x66, 0xf6, 0xc8, 0x39, 0x8c, 0x72, 0x8e, 0xeb, 0x32,
+	0x40, 0x21, 0x38, 0xb1, 0x8a, 0x28, 0x28, 0x12, 0xa4, 0x41, 0x0a, 0x45, 0x96, 0x2b, 0x23, 0xb1,
+	0xe4, 0x50, 0x36, 0x8c, 0x14, 0x68, 0x8d, 0x35, 0xb9, 0xb0, 0x09, 0x53, 0x5c, 0x76, 0x77, 0xe5,
+	0x56, 0xf7, 0x6d, 0xd1, 0x57, 0x28, 0x10, 0x07, 0x6d, 0xef, 0x0a, 0xf4, 0x1d, 0xfa, 0x02, 0xed,
+	0x55, 0xaf, 0x7b, 0xdf, 0x9f, 0xcb, 0xbe, 0x40, 0xb1, 0x4b, 0x52, 0xa2, 0x2c, 0x59, 0x4d, 0x80,
+	0xdc, 0xed, 0xfc, 0x7d, 0x9c, 0x99, 0x9d, 0x9d, 0x19, 0xc2, 0x32, 0x71, 0x8e, 0xc9, 0xa1, 0x2d,
+	0x98, 0x57, 0x0b, 0x18, 0x15, 0x14, 0x2d, 0x26, 0x18, 0x47, 0xe6, 0x37, 0x1a, 0x94, 0x7a, 0x84,
+	0x9d, 0x11, 0xd6, 0x26, 0x9e, 0x47, 0x91, 0x01, 0xf9, 0x33, 0xc2, 0xb8, 0x4b, 0x7d, 0x43, 0x5b,
+	0xd3, 0xaa, 0x45, 0x2b, 0x26, 0xd1, 0x3d, 0xc8, 0x3a, 0x58, 0x60, 0x23, 0xbd, 0x96, 0xa9, 0x96,
+	0xea, 0x37, 0x6b, 0x49, 0x98, 0x5a, 0x02, 0xa2, 0xb6, 0x89, 0x05, 0x6e, 0xf9, 0x82, 0x0d, 0x2d,
+	0x65, 0x50, 0xb9, 0x07, 0xc5, 0x11, 0x0b, 0xe9, 0x90, 0x39, 0x25, 0xc3, 0x08, 0x5b, 0x1e, 0x51,
+	0x19, 0x72, 0x67, 0xd8, 0x1b, 0x10, 0x23, 0xad, 0x78, 0x21, 0xf1, 0x20, 0x7d, 0x5f, 0x33, 0x7f,
+	0xd5, 0xa0, 0xd4, 0xf4, 0x5c, 0xe2, 0x8b, 0x7f, 0xf3, 0xad, 0x02, 0x85, 0x13, 0xca, 0x85, 0x8f,
+	0xfb, 0x31, 0xcc, 0x88, 0x46, 0xff, 0x83, 0xa2, 0x0a, 0xdc, 0xa6, 0x1e, 0x37, 0x32, 0x6b, 0x99,
+	0x6a, 0xd1, 0x1a, 0x33, 0x46, 0x51, 0x65, 0x67, 0x45, 0x95, 0xf8, 0xf8, 0x9b, 0x8b, 0xea, 0x09,
+	0xe4, 0x5a, 0x8c, 0x51, 0x86, 0x10, 0x64, 0x6d, 0xea, 0x90, 0xc8, 0x4a, 0x9d, 0x65, 0x88, 0x7d,
+	0xc2, 0x39, 0x3e, 0x8e, 0x0d, 0x63, 0x52, 0x02, 0xda, 0x78, 0xc0, 0x89, 0x91, 0x09, 0x01, 0x15,
+	0x61, 0x7e, 0x0c, 0x79, 0x99, 0x7a, 0xd7, 0x26, 0x68, 0x09, 0xd2, 0xae, 0x13, 0x81, 0xa5, 0x5d,
+	0x47, 0xc2, 0x27, 0xf2, 0xa1, 0xce, 0xa8, 0x06, 0x88, 0xf8, 0x36, 0x1b, 0x06, 0xc2, 0xa5, 0xbe,
+	0x45, 0x3e, 0x1d, 0xb8, 0x8c, 0x38, 0x0a, 0xb1, 0x60, 0xcd, 0x90, 0x98, 0x7f, 0x6b, 0x12, 0x9f,
+	0xab, 0x1c, 0x97, 0x21, 0x27, 0xe8, 0x29, 0x89, 0x73, 0x1f, 0x12, 0x68, 0x03, 0xb2, 0x62, 0x18,
+	0x84, 0x5f, 0x59, 0xaa, 0x5f, 0xbf, 0x58, 0x15, 0xca, 0x74, 0x6f, 0x18, 0x10, 0x4b, 0xa9, 0xa1,
+	0x75, 0xd0, 0x6d, 0xc2, 0xc4, 0x96, 0xeb, 0x1f, 0x13, 0x16, 0x30, 0xd7, 0x17, 0xf1, 0x9d, 0x4c,
+	0xf1, 0x65, 0x00, 0x03, 0xe6, 0x71, 0x75, 0x35, 0x45, 0x4b, 0x9d, 0xd1, 0xbb, 0x90, 0xe7, 0x61,
+	0xbc, 0x46, 0x6e, 0x4d, 0xab, 0x96, 0xea, 0x2b, 0xd3, 0x75, 0xe8, 0xda, 0xc4, 0x8a, 0xb5, 0xa2,
+	0xac, 0xe4, 0x47, 0x59, 0x31, 0x61, 0x11, 0x07, 0x6e, 0xe4, 0xd8, 0xb6, 0x63, 0x14, 0x94, 0x64,
+	0x82, 0x67, 0x7e, 0x02, 0xd0, 0x18, 0xd1, 0x97, 0xc4, 0x3d, 0x2b, 0x90, 0xf4, 0x25, 0x81, 0x84,
+	0x3e, 0x64, 0x62, 0x1f, 0x4c, 0x0a, 0xcb, 0x63, 0xfc, 0x86, 0xe3, 0x10, 0x07, 0xad, 0x41, 0xc9,
+	0xe5, 0x5b, 0x03, 0xcf, 0xeb, 0x09, 0x2c, 0xc2, 0x92, 0x28, 0x58, 0x49, 0x16, 0x7a, 0x00, 0xa5,
+	0xb1, 0x93, 0x3c, 0x7a, 0x85, 0xc6, 0x64, 0xf4, 0x63, 0x54, 0x2b, 0xa9, 0x6c, 0x76, 0xe1, 0xea,
+	0x58, 0xb4, 0x1f, 0x38, 0x58, 0x10, 0xe7, 0x22, 0xa0, 0xf6, 0x3a, 0x80, 0xb7, 0x92, 0x80, 0x16,
+	0xe9, 0xd3, 0x33, 0xe2, 0xa0, 0x6b, 0xb0, 0xa0, 0x72, 0x13, 0x62, 0x15, 0xad, 0x88, 0x32, 0x37,
+	0xe0, 0x3f, 0x63, 0xe5, 0x36, 0xc1, 0x4c, 0x1c, 0x11, 0x2c, 0x2e, 0x55, 0xb7, 0x61, 0xf1, 0x35,
+	0x53, 0x73, 0x07, 0x0a, 0x7c, 0x32, 0x2f, 0x2b, 0x33, 0xeb, 0xd0, 0x1a, 0xa9, 0x99, 0x55, 0x58,
+	0x7a, 0x45, 0xef, 0x4f, 0x47, 0x9a, 0x71, 0xe2, 0x66, 0x17, 0x44, 0x5c, 0xad, 0xe9, 0xd9, 0xd5,
+	0x9a, 0x79, 0x95, 0x6a, 0x35, 0xbf, 0xce, 0xc2, 0xe2, 0x2e, 0xe5, 0x62, 0xc0, 0xc8, 0xb3, 0x01,
+	0x61, 0xc3, 0xa9, 0x47, 0xfd, 0x0e, 0x2c, 0x05, 0xa1, 0xbc, 0x79, 0x42, 0xec, 0xd3, 0x6d, 0xc7,
+	0x28, 0x2b, 0xd9, 0x05, 0xae, 0x4c, 0x9a, 0xe3, 0xf2, 0xc0, 0xc3, 0xc3, 0x8e, 0xec, 0x01, 0xab,
+	0x4a, 0x29, 0xc9, 0x42, 0x77, 0xa3, 0x87, 0x5b, 0x55, 0x0f, 0xf7, 0xad, 0x49, 0xc7, 0x92, 0x3e,
+	0xd4, 0x12, 0xcf, 0x37, 0xd1, 0x81, 0xeb, 0x93, 0x1d, 0xf8, 0x0e, 0xa4, 0x7d, 0x6c, 0x3c, 0x54,
+	0x51, 0xce, 0x03, 0xeb, 0x50, 0x9f, 0xb4, 0x53, 0x56, 0xda, 0xc7, 0xe8, 0x11, 0xe4, 0x03, 0x46,
+	0x6d, 0xc2, 0xb9, 0xb1, 0xa5, 0xec, 0xcc, 0x39, 0x76, 0xbb, 0xa1, 0x66, 0x3b, 0x65, 0xc5, 0x46,
+	0x95, 0x05, 0xc8, 0x4a, 0xb4, 0x0a, 0x85, 0x7c, 0x24, 0x95, 0x57, 0x13, 0x60, 0x71, 0x12, 0xdf,
+	0x61, 0x48, 0xa0, 0x0e, 0x5c, 0x39, 0xc1, 0xfc, 0xa4, 0xe1, 0x1d, 0x53, 0xe6, 0x8a, 0x93, 0xbe,
+	0x01, 0x2a, 0xe6, 0xea, 0x9c, 0xcf, 0xb5, 0x93, 0xfa, 0xd6, 0xa4, 0xb9, 0x79, 0x1f, 0xb2, 0x32,
+	0x27, 0x68, 0x01, 0xd2, 0xdd, 0x9e, 0x9e, 0x42, 0x79, 0xc8, 0xec, 0x34, 0x9a, 0x3a, 0x20, 0x04,
+	0x4b, 0x07, 0xdb, 0x9d, 0xcd, 0xee, 0x41, 0xef, 0x70, 0xb3, 0xbb, 0xd3, 0xd8, 0xee, 0xe8, 0x65,
+	0x54, 0x82, 0xfc, 0xae, 0xd5, 0x6d, 0xb6, 0x7a, 0x3d, 0x7d, 0xd5, 0xbc, 0x01, 0x57, 0x26, 0x90,
+	0x11, 0xc0, 0x42, 0xaf, 0xdd, 0x78, 0xef, 0x4e, 0x5d, 0x4f, 0x3d, 0x5e, 0x04, 0x08, 0x30, 0xc3,
+	0x7d, 0x22, 0x08, 0xe3, 0xe6, 0x0f, 0x05, 0x58, 0x8e, 0x5c, 0xb2, 0x08, 0x0f, 0xa8, 0xcf, 0xa7,
+	0x5b, 0xfc, 0xfb, 0x90, 0x23, 0x72, 0x94, 0xa8, 0x22, 0x98, 0x9a, 0x5e, 0x17, 0xac, 0x6b, 0x6a,
+	0xea, 0xb4, 0x53, 0x56, 0x68, 0x93, 0x4c, 0xff, 0xea, 0x9c, 0xf4, 0x8f, 0xcc, 0x65, 0x8e, 0x13,
+	0xe9, 0x47, 0x8f, 0x20, 0xd3, 0xc7, 0xb6, 0xaa, 0x9f, 0x52, 0x7d, 0x7d, 0xbe, 0xed, 0x0e, 0xb6,
+	0x1b, 0x8e, 0xc3, 0x08, 0xe7, 0x44, 0x5e, 0xa1, 0x34, 0x44, 0x2d, 0x58, 0x70, 0x68, 0x1f, 0xbb,
+	0x61, 0x29, 0x95, 0xea, 0xb7, 0xe6, 0x43, 0x1c, 0xb8, 0xbe, 0x43, 0x3f, 0xe3, 0x9b, 0xca, 0xa4,
+	0x9d, 0xb2, 0x22, 0x63, 0xf4, 0x01, 0xa4, 0x29, 0x8f, 0x0a, 0x6f, 0x63, 0x3e, 0x44, 0x37, 0x20,
+	0x0c, 0x0b, 0xd7, 0x3f, 0xee, 0x0d, 0xb9, 0x20, 0x7d, 0x59, 0x86, 0x94, 0x57, 0x7e, 0x4c, 0xc7,
+	0x03, 0xf9, 0x61, 0x62, 0x20, 0x5f, 0x56, 0x1e, 0x93, 0xd9, 0xac, 0x35, 0xa9, 0x43, 0xa6, 0x47,
+	0x37, 0x4c, 0x8e, 0xee, 0x46, 0xb4, 0x63, 0x94, 0x55, 0x6f, 0xda, 0x78, 0x15, 0xdc, 0x37, 0xb6,
+	0x6d, 0x74, 0x21, 0x2b, 0x7d, 0x94, 0x65, 0xb8, 0xdf, 0x79, 0xd2, 0xe9, 0x1e, 0x74, 0xf4, 0x14,
+	0xaa, 0xc0, 0xb5, 0xfd, 0x4e, 0x6f, 0x7f, 0x77, 0xb7, 0x6b, 0xed, 0xb5, 0x36, 0x0f, 0x9f, 0xed,
+	0xb7, 0xac, 0xe7, 0x87, 0x7b, 0xcf, 0x77, 0x5b, 0x3a, 0xa0, 0x55, 0xa8, 0x24, 0x65, 0xed, 0x46,
+	0xaf, 0x7d, 0xd8, 0x78, 0xfa, 0x61, 0xd7, 0xda, 0xde, 0x6b, 0xef, 0xe8, 0xe5, 0xca, 0x1e, 0x64,
+	0x65, 0x25, 0xa0, 0x55, 0x80, 0x23, 0xd7, 0xc7, 0x6c, 0x28, 0x0b, 0x3a, 0xf2, 0x25, 0xc1, 0x41,
+	0xb7, 0xe1, 0x2a, 0x77, 0x8f, 0x7d, 0xc2, 0x12, 0xa3, 0x30, 0x4a, 0xcc, 0xb4, 0xa0, 0x72, 0x1b,
+	0x16, 0x93, 0x35, 0x22, 0x97, 0x36, 0x1c, 0x13, 0xd1, 0x63, 0x1e, 0x33, 0x2a, 0x37, 0xe1, 0xca,
+	0x44, 0x39, 0x8c, 0x76, 0x1d, 0x6d, 0xbc, 0xeb, 0x54, 0x7e, 0xd3, 0x60, 0xf9, 0xc2, 0x8d, 0xa3,
+	0xad, 0xa8, 0xe9, 0x85, 0x37, 0x5c, 0x7f, 0xad, 0x72, 0xb9, 0xa4, 0x0f, 0xc2, 0x64, 0x1f, 0x2c,
+	0x43, 0xee, 0x68, 0xe0, 0x7a, 0x71, 0x5f, 0x0e, 0x09, 0xd3, 0x8a, 0x3a, 0x46, 0x09, 0xf2, 0x0d,
+	0xdf, 0x61, 0xd4, 0x75, 0xc2, 0xb6, 0xe1, 0x76, 0x7b, 0x3a, 0xa0, 0x22, 0xe4, 0x9e, 0xba, 0xfe,
+	0xe0, 0x73, 0xbd, 0x2c, 0x8f, 0x7d, 0x6c, 0x77, 0x7b, 0xfa, 0xaa, 0xd4, 0x8d, 0x82, 0xd4, 0xab,
+	0xe8, 0xea, 0x28, 0xe2, 0x70, 0xd3, 0xd6, 0xeb, 0x8f, 0x8b, 0x90, 0x0f, 0xf0, 0xd0, 0xa3, 0xd8,
+	0x59, 0xff, 0x29, 0x0d, 0xa5, 0x26, 0xf5, 0x05, 0xf1, 0x85, 0xfa, 0x4c, 0x01, 0xb2, 0x1f, 0x11,
+	0x46, 0xf5, 0x14, 0x5a, 0x81, 0xe5, 0xc4, 0x6a, 0x2e, 0x85, 0xfa, 0xb7, 0x2f, 0x34, 0xc9, 0x4e,
+	0xec, 0xb6, 0x8a, 0xfd, 0xdd, 0x0b, 0x0d, 0x2d, 0x43, 0x51, 0x95, 0x9f, 0x62, 0x7c, 0xff, 0x42,
+	0x43, 0xd7, 0x40, 0x4f, 0xce, 0x62, 0xc5, 0xff, 0xe2, 0x5c, 0x43, 0x06, 0xa0, 0xc9, 0xa1, 0xa8,
+	0x24, 0x5f, 0x4e, 0x48, 0xa2, 0xc1, 0xaa, 0x24, 0x5f, 0x9d, 0x6b, 0xe8, 0x7a, 0x72, 0x0d, 0x18,
+	0xc3, 0xfd, 0x7e, 0xae, 0xa1, 0x1b, 0xb0, 0x32, 0xb5, 0x9f, 0x28, 0xe1, 0x1f, 0x17, 0x85, 0x49,
+	0xd0, 0x3f, 0xcf, 0x35, 0xf4, 0x7f, 0xf8, 0xef, 0x8c, 0xdd, 0x42, 0x89, 0xff, 0x3a, 0xd7, 0x90,
+	0x0e, 0xd0, 0xf2, 0x19, 0xf5, 0x3c, 0xc5, 0xf9, 0xf9, 0xa5, 0x8a, 0x3c, 0xe4, 0x34, 0x09, 0x13,
+	0x5c, 0xb1, 0x7f, 0x79, 0xa9, 0xad, 0xbf, 0x2d, 0xff, 0x82, 0x46, 0xcb, 0xaa, 0x4c, 0xe0, 0xa6,
+	0x8b, 0x3d, 0x3d, 0x25, 0x4f, 0x8f, 0x5d, 0xdf, 0xd1, 0xb5, 0xa3, 0x05, 0xf5, 0xd3, 0x70, 0xf7,
+	0x9f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x3f, 0xe4, 0x24, 0x57, 0x51, 0x0d, 0x00, 0x00,
 }

pb/edge_ctrl_pb/edge_ctrl.proto

@@ -54,11 +54,13 @@ message Session {
     repeated string urls = 4;
     Service service = 5;
     string id = 7;
+    string apiSessionId = 8;
 }
 
 message ApiSession {
     string token = 1;
     repeated string certFingerprints = 2;
+    string id = 3;
 }
 
 message ApiSessionAdded {

rest_client/current_api_session/create_current_api_session_certificate_parameters.go

@@ -0,0 +1,162 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// NewCreateCurrentAPISessionCertificateParams creates a new CreateCurrentAPISessionCertificateParams object
+// with the default values initialized.
+func NewCreateCurrentAPISessionCertificateParams() *CreateCurrentAPISessionCertificateParams {
+	var ()
+	return &CreateCurrentAPISessionCertificateParams{
+
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewCreateCurrentAPISessionCertificateParamsWithTimeout creates a new CreateCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a timeout on a request
+func NewCreateCurrentAPISessionCertificateParamsWithTimeout(timeout time.Duration) *CreateCurrentAPISessionCertificateParams {
+	var ()
+	return &CreateCurrentAPISessionCertificateParams{
+
+		timeout: timeout,
+	}
+}
+
+// NewCreateCurrentAPISessionCertificateParamsWithContext creates a new CreateCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a context for a request
+func NewCreateCurrentAPISessionCertificateParamsWithContext(ctx context.Context) *CreateCurrentAPISessionCertificateParams {
+	var ()
+	return &CreateCurrentAPISessionCertificateParams{
+
+		Context: ctx,
+	}
+}
+
+// NewCreateCurrentAPISessionCertificateParamsWithHTTPClient creates a new CreateCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a custom HTTPClient for a request
+func NewCreateCurrentAPISessionCertificateParamsWithHTTPClient(client *http.Client) *CreateCurrentAPISessionCertificateParams {
+	var ()
+	return &CreateCurrentAPISessionCertificateParams{
+		HTTPClient: client,
+	}
+}
+
+/*CreateCurrentAPISessionCertificateParams contains all the parameters to send to the API endpoint
+for the create current Api session certificate operation typically these are written to a http.Request
+*/
+type CreateCurrentAPISessionCertificateParams struct {
+
+	/*Body
+	  The payload describing the CSR used to create a session certificate
+
+	*/
+	Body *rest_model.CurrentAPISessionCertificateCreate
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithTimeout adds the timeout to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) WithTimeout(timeout time.Duration) *CreateCurrentAPISessionCertificateParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) WithContext(ctx context.Context) *CreateCurrentAPISessionCertificateParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) WithHTTPClient(client *http.Client) *CreateCurrentAPISessionCertificateParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithBody adds the body to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) WithBody(body *rest_model.CurrentAPISessionCertificateCreate) *CreateCurrentAPISessionCertificateParams {
+	o.SetBody(body)
+	return o
+}
+
+// SetBody adds the body to the create current Api session certificate params
+func (o *CreateCurrentAPISessionCertificateParams) SetBody(body *rest_model.CurrentAPISessionCertificateCreate) {
+	o.Body = body
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *CreateCurrentAPISessionCertificateParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if o.Body != nil {
+		if err := r.SetBodyParam(o.Body); err != nil {
+			return err
+		}
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client/current_api_session/create_current_api_session_certificate_responses.go

@@ -0,0 +1,171 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// CreateCurrentAPISessionCertificateReader is a Reader for the CreateCurrentAPISessionCertificate structure.
+type CreateCurrentAPISessionCertificateReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *CreateCurrentAPISessionCertificateReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewCreateCurrentAPISessionCertificateOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 400:
+		result := NewCreateCurrentAPISessionCertificateBadRequest()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 401:
+		result := NewCreateCurrentAPISessionCertificateUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+
+	default:
+		return nil, runtime.NewAPIError("response status code does not match any response statuses defined for this endpoint in the swagger spec", response, response.Code())
+	}
+}
+
+// NewCreateCurrentAPISessionCertificateOK creates a CreateCurrentAPISessionCertificateOK with default headers values
+func NewCreateCurrentAPISessionCertificateOK() *CreateCurrentAPISessionCertificateOK {
+	return &CreateCurrentAPISessionCertificateOK{}
+}
+
+/*CreateCurrentAPISessionCertificateOK handles this case with default header values.
+
+A response of a create API Session certificate
+*/
+type CreateCurrentAPISessionCertificateOK struct {
+	Payload *rest_model.CreateCurrentAPISessionCertificateEnvelope
+}
+
+func (o *CreateCurrentAPISessionCertificateOK) Error() string {
+	return fmt.Sprintf("[POST /current-api-session/certificates][%d] createCurrentApiSessionCertificateOK  %+v", 200, o.Payload)
+}
+
+func (o *CreateCurrentAPISessionCertificateOK) GetPayload() *rest_model.CreateCurrentAPISessionCertificateEnvelope {
+	return o.Payload
+}
+
+func (o *CreateCurrentAPISessionCertificateOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.CreateCurrentAPISessionCertificateEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewCreateCurrentAPISessionCertificateBadRequest creates a CreateCurrentAPISessionCertificateBadRequest with default headers values
+func NewCreateCurrentAPISessionCertificateBadRequest() *CreateCurrentAPISessionCertificateBadRequest {
+	return &CreateCurrentAPISessionCertificateBadRequest{}
+}
+
+/*CreateCurrentAPISessionCertificateBadRequest handles this case with default header values.
+
+The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
+*/
+type CreateCurrentAPISessionCertificateBadRequest struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *CreateCurrentAPISessionCertificateBadRequest) Error() string {
+	return fmt.Sprintf("[POST /current-api-session/certificates][%d] createCurrentApiSessionCertificateBadRequest  %+v", 400, o.Payload)
+}
+
+func (o *CreateCurrentAPISessionCertificateBadRequest) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *CreateCurrentAPISessionCertificateBadRequest) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewCreateCurrentAPISessionCertificateUnauthorized creates a CreateCurrentAPISessionCertificateUnauthorized with default headers values
+func NewCreateCurrentAPISessionCertificateUnauthorized() *CreateCurrentAPISessionCertificateUnauthorized {
+	return &CreateCurrentAPISessionCertificateUnauthorized{}
+}
+
+/*CreateCurrentAPISessionCertificateUnauthorized handles this case with default header values.
+
+The currently supplied session does not have the correct access rights to request this resource
+*/
+type CreateCurrentAPISessionCertificateUnauthorized struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *CreateCurrentAPISessionCertificateUnauthorized) Error() string {
+	return fmt.Sprintf("[POST /current-api-session/certificates][%d] createCurrentApiSessionCertificateUnauthorized  %+v", 401, o.Payload)
+}
+
+func (o *CreateCurrentAPISessionCertificateUnauthorized) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *CreateCurrentAPISessionCertificateUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}

rest_client/current_api_session/current_api_session_client.go

@@ -53,12 +53,20 @@ type Client struct {
 type ClientService interface {
 	DeleteCurrentAPISession(params *DeleteCurrentAPISessionParams, authInfo runtime.ClientAuthInfoWriter) (*DeleteCurrentAPISessionOK, error)
 
+	CreateCurrentAPISessionCertificate(params *CreateCurrentAPISessionCertificateParams, authInfo runtime.ClientAuthInfoWriter) (*CreateCurrentAPISessionCertificateOK, error)
+
+	DeleteCurrentAPISessionCertificate(params *DeleteCurrentAPISessionCertificateParams, authInfo runtime.ClientAuthInfoWriter) (*DeleteCurrentAPISessionCertificateOK, error)
+
+	DetailCurrentAPISessionCertificate(params *DetailCurrentAPISessionCertificateParams, authInfo runtime.ClientAuthInfoWriter) (*DetailCurrentAPISessionCertificateOK, error)
+
 	DetailCurrentIdentityAuthenticator(params *DetailCurrentIdentityAuthenticatorParams, authInfo runtime.ClientAuthInfoWriter) (*DetailCurrentIdentityAuthenticatorOK, error)
 
 	GetCurrentAPISession(params *GetCurrentAPISessionParams, authInfo runtime.ClientAuthInfoWriter) (*GetCurrentAPISessionOK, error)
 
 	GetCurrentIdentity(params *GetCurrentIdentityParams, authInfo runtime.ClientAuthInfoWriter) (*GetCurrentIdentityOK, error)
 
+	ListCurrentAPISessionCertificates(params *ListCurrentAPISessionCertificatesParams, authInfo runtime.ClientAuthInfoWriter) (*ListCurrentAPISessionCertificatesOK, error)
+
 	ListCurrentIdentityAuthenticators(params *ListCurrentIdentityAuthenticatorsParams, authInfo runtime.ClientAuthInfoWriter) (*ListCurrentIdentityAuthenticatorsOK, error)
 
 	PatchCurrentIdentityAuthenticator(params *PatchCurrentIdentityAuthenticatorParams, authInfo runtime.ClientAuthInfoWriter) (*PatchCurrentIdentityAuthenticatorOK, error)
@@ -105,6 +113,118 @@ func (a *Client) DeleteCurrentAPISession(params *DeleteCurrentAPISessionParams,
 	panic(msg)
 }
 
+/*
+  CreateCurrentAPISessionCertificate creates an ephemeral certificate for the current API session
+
+  Creates an ephemeral certificate for the current API Session. This endpoint expects a PEM encoded CSRs to be provided for fulfillment as a property of a JSON payload. It is up to the client to manage the private key backing the CSR request.
+*/
+func (a *Client) CreateCurrentAPISessionCertificate(params *CreateCurrentAPISessionCertificateParams, authInfo runtime.ClientAuthInfoWriter) (*CreateCurrentAPISessionCertificateOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewCreateCurrentAPISessionCertificateParams()
+	}
+
+	result, err := a.transport.Submit(&runtime.ClientOperation{
+		ID:                 "createCurrentApiSessionCertificate",
+		Method:             "POST",
+		PathPattern:        "/current-api-session/certificates",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &CreateCurrentAPISessionCertificateReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*CreateCurrentAPISessionCertificateOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for createCurrentApiSessionCertificate: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+/*
+  DeleteCurrentAPISessionCertificate deletes an ephemeral certificate
+
+  Delete an ephemeral certificateby id
+
+*/
+func (a *Client) DeleteCurrentAPISessionCertificate(params *DeleteCurrentAPISessionCertificateParams, authInfo runtime.ClientAuthInfoWriter) (*DeleteCurrentAPISessionCertificateOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewDeleteCurrentAPISessionCertificateParams()
+	}
+
+	result, err := a.transport.Submit(&runtime.ClientOperation{
+		ID:                 "deleteCurrentApiSessionCertificate",
+		Method:             "DELETE",
+		PathPattern:        "/current-api-session/certificates/{id}",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &DeleteCurrentAPISessionCertificateReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*DeleteCurrentAPISessionCertificateOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for deleteCurrentApiSessionCertificate: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
+/*
+  DetailCurrentAPISessionCertificate retrieves an ephemeral certificate
+
+  Retrieves a single ephemeral certificate by id
+*/
+func (a *Client) DetailCurrentAPISessionCertificate(params *DetailCurrentAPISessionCertificateParams, authInfo runtime.ClientAuthInfoWriter) (*DetailCurrentAPISessionCertificateOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewDetailCurrentAPISessionCertificateParams()
+	}
+
+	result, err := a.transport.Submit(&runtime.ClientOperation{
+		ID:                 "detailCurrentApiSessionCertificate",
+		Method:             "GET",
+		PathPattern:        "/current-api-session/certificates/{id}",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &DetailCurrentAPISessionCertificateReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*DetailCurrentAPISessionCertificateOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for detailCurrentApiSessionCertificate: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
   DetailCurrentIdentityAuthenticator retrieves an authenticator for the current identity
 
@@ -216,6 +336,43 @@ func (a *Client) GetCurrentIdentity(params *GetCurrentIdentityParams, authInfo r
 	panic(msg)
 }
 
+/*
+  ListCurrentAPISessionCertificates lists the ephemeral certificates available for the current API session
+
+  Retrieves a list of certificate resources for the current API session; supports filtering, sorting, and pagination
+*/
+func (a *Client) ListCurrentAPISessionCertificates(params *ListCurrentAPISessionCertificatesParams, authInfo runtime.ClientAuthInfoWriter) (*ListCurrentAPISessionCertificatesOK, error) {
+	// TODO: Validate the params before sending
+	if params == nil {
+		params = NewListCurrentAPISessionCertificatesParams()
+	}
+
+	result, err := a.transport.Submit(&runtime.ClientOperation{
+		ID:                 "listCurrentApiSessionCertificates",
+		Method:             "GET",
+		PathPattern:        "/current-api-session/certificates",
+		ProducesMediaTypes: []string{"application/json"},
+		ConsumesMediaTypes: []string{"application/json"},
+		Schemes:            []string{"https"},
+		Params:             params,
+		Reader:             &ListCurrentAPISessionCertificatesReader{formats: a.formats},
+		AuthInfo:           authInfo,
+		Context:            params.Context,
+		Client:             params.HTTPClient,
+	})
+	if err != nil {
+		return nil, err
+	}
+	success, ok := result.(*ListCurrentAPISessionCertificatesOK)
+	if ok {
+		return success, nil
+	}
+	// unexpected success response
+	// safeguard: normally, absent a default response, unknown success responses return an error above: so this is a codegen issue
+	msg := fmt.Sprintf("unexpected success response for listCurrentApiSessionCertificates: API contract not enforced by server. Client expected to get an error, but got: %T", result)
+	panic(msg)
+}
+
 /*
   ListCurrentIdentityAuthenticators lists authenticators for the current identity
 

rest_client/current_api_session/delete_current_api_session_certificate_parameters.go

@@ -0,0 +1,159 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewDeleteCurrentAPISessionCertificateParams creates a new DeleteCurrentAPISessionCertificateParams object
+// with the default values initialized.
+func NewDeleteCurrentAPISessionCertificateParams() *DeleteCurrentAPISessionCertificateParams {
+	var ()
+	return &DeleteCurrentAPISessionCertificateParams{
+
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewDeleteCurrentAPISessionCertificateParamsWithTimeout creates a new DeleteCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a timeout on a request
+func NewDeleteCurrentAPISessionCertificateParamsWithTimeout(timeout time.Duration) *DeleteCurrentAPISessionCertificateParams {
+	var ()
+	return &DeleteCurrentAPISessionCertificateParams{
+
+		timeout: timeout,
+	}
+}
+
+// NewDeleteCurrentAPISessionCertificateParamsWithContext creates a new DeleteCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a context for a request
+func NewDeleteCurrentAPISessionCertificateParamsWithContext(ctx context.Context) *DeleteCurrentAPISessionCertificateParams {
+	var ()
+	return &DeleteCurrentAPISessionCertificateParams{
+
+		Context: ctx,
+	}
+}
+
+// NewDeleteCurrentAPISessionCertificateParamsWithHTTPClient creates a new DeleteCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a custom HTTPClient for a request
+func NewDeleteCurrentAPISessionCertificateParamsWithHTTPClient(client *http.Client) *DeleteCurrentAPISessionCertificateParams {
+	var ()
+	return &DeleteCurrentAPISessionCertificateParams{
+		HTTPClient: client,
+	}
+}
+
+/*DeleteCurrentAPISessionCertificateParams contains all the parameters to send to the API endpoint
+for the delete current Api session certificate operation typically these are written to a http.Request
+*/
+type DeleteCurrentAPISessionCertificateParams struct {
+
+	/*ID
+	  The id of the requested resource
+
+	*/
+	ID string
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithTimeout adds the timeout to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) WithTimeout(timeout time.Duration) *DeleteCurrentAPISessionCertificateParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) WithContext(ctx context.Context) *DeleteCurrentAPISessionCertificateParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) WithHTTPClient(client *http.Client) *DeleteCurrentAPISessionCertificateParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithID adds the id to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) WithID(id string) *DeleteCurrentAPISessionCertificateParams {
+	o.SetID(id)
+	return o
+}
+
+// SetID adds the id to the delete current Api session certificate params
+func (o *DeleteCurrentAPISessionCertificateParams) SetID(id string) {
+	o.ID = id
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *DeleteCurrentAPISessionCertificateParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	// path param id
+	if err := r.SetPathParam("id", o.ID); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client/current_api_session/delete_current_api_session_certificate_responses.go

@@ -0,0 +1,171 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// DeleteCurrentAPISessionCertificateReader is a Reader for the DeleteCurrentAPISessionCertificate structure.
+type DeleteCurrentAPISessionCertificateReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *DeleteCurrentAPISessionCertificateReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewDeleteCurrentAPISessionCertificateOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 400:
+		result := NewDeleteCurrentAPISessionCertificateBadRequest()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 401:
+		result := NewDeleteCurrentAPISessionCertificateUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+
+	default:
+		return nil, runtime.NewAPIError("response status code does not match any response statuses defined for this endpoint in the swagger spec", response, response.Code())
+	}
+}
+
+// NewDeleteCurrentAPISessionCertificateOK creates a DeleteCurrentAPISessionCertificateOK with default headers values
+func NewDeleteCurrentAPISessionCertificateOK() *DeleteCurrentAPISessionCertificateOK {
+	return &DeleteCurrentAPISessionCertificateOK{}
+}
+
+/*DeleteCurrentAPISessionCertificateOK handles this case with default header values.
+
+The delete request was successful and the resource has been removed
+*/
+type DeleteCurrentAPISessionCertificateOK struct {
+	Payload *rest_model.Empty
+}
+
+func (o *DeleteCurrentAPISessionCertificateOK) Error() string {
+	return fmt.Sprintf("[DELETE /current-api-session/certificates/{id}][%d] deleteCurrentApiSessionCertificateOK  %+v", 200, o.Payload)
+}
+
+func (o *DeleteCurrentAPISessionCertificateOK) GetPayload() *rest_model.Empty {
+	return o.Payload
+}
+
+func (o *DeleteCurrentAPISessionCertificateOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.Empty)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewDeleteCurrentAPISessionCertificateBadRequest creates a DeleteCurrentAPISessionCertificateBadRequest with default headers values
+func NewDeleteCurrentAPISessionCertificateBadRequest() *DeleteCurrentAPISessionCertificateBadRequest {
+	return &DeleteCurrentAPISessionCertificateBadRequest{}
+}
+
+/*DeleteCurrentAPISessionCertificateBadRequest handles this case with default header values.
+
+The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
+*/
+type DeleteCurrentAPISessionCertificateBadRequest struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *DeleteCurrentAPISessionCertificateBadRequest) Error() string {
+	return fmt.Sprintf("[DELETE /current-api-session/certificates/{id}][%d] deleteCurrentApiSessionCertificateBadRequest  %+v", 400, o.Payload)
+}
+
+func (o *DeleteCurrentAPISessionCertificateBadRequest) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *DeleteCurrentAPISessionCertificateBadRequest) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewDeleteCurrentAPISessionCertificateUnauthorized creates a DeleteCurrentAPISessionCertificateUnauthorized with default headers values
+func NewDeleteCurrentAPISessionCertificateUnauthorized() *DeleteCurrentAPISessionCertificateUnauthorized {
+	return &DeleteCurrentAPISessionCertificateUnauthorized{}
+}
+
+/*DeleteCurrentAPISessionCertificateUnauthorized handles this case with default header values.
+
+The currently supplied session does not have the correct access rights to request this resource
+*/
+type DeleteCurrentAPISessionCertificateUnauthorized struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *DeleteCurrentAPISessionCertificateUnauthorized) Error() string {
+	return fmt.Sprintf("[DELETE /current-api-session/certificates/{id}][%d] deleteCurrentApiSessionCertificateUnauthorized  %+v", 401, o.Payload)
+}
+
+func (o *DeleteCurrentAPISessionCertificateUnauthorized) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *DeleteCurrentAPISessionCertificateUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}

rest_client/current_api_session/detail_current_api_session_certificate_parameters.go

@@ -0,0 +1,159 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewDetailCurrentAPISessionCertificateParams creates a new DetailCurrentAPISessionCertificateParams object
+// with the default values initialized.
+func NewDetailCurrentAPISessionCertificateParams() *DetailCurrentAPISessionCertificateParams {
+	var ()
+	return &DetailCurrentAPISessionCertificateParams{
+
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewDetailCurrentAPISessionCertificateParamsWithTimeout creates a new DetailCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a timeout on a request
+func NewDetailCurrentAPISessionCertificateParamsWithTimeout(timeout time.Duration) *DetailCurrentAPISessionCertificateParams {
+	var ()
+	return &DetailCurrentAPISessionCertificateParams{
+
+		timeout: timeout,
+	}
+}
+
+// NewDetailCurrentAPISessionCertificateParamsWithContext creates a new DetailCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a context for a request
+func NewDetailCurrentAPISessionCertificateParamsWithContext(ctx context.Context) *DetailCurrentAPISessionCertificateParams {
+	var ()
+	return &DetailCurrentAPISessionCertificateParams{
+
+		Context: ctx,
+	}
+}
+
+// NewDetailCurrentAPISessionCertificateParamsWithHTTPClient creates a new DetailCurrentAPISessionCertificateParams object
+// with the default values initialized, and the ability to set a custom HTTPClient for a request
+func NewDetailCurrentAPISessionCertificateParamsWithHTTPClient(client *http.Client) *DetailCurrentAPISessionCertificateParams {
+	var ()
+	return &DetailCurrentAPISessionCertificateParams{
+		HTTPClient: client,
+	}
+}
+
+/*DetailCurrentAPISessionCertificateParams contains all the parameters to send to the API endpoint
+for the detail current Api session certificate operation typically these are written to a http.Request
+*/
+type DetailCurrentAPISessionCertificateParams struct {
+
+	/*ID
+	  The id of the requested resource
+
+	*/
+	ID string
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithTimeout adds the timeout to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) WithTimeout(timeout time.Duration) *DetailCurrentAPISessionCertificateParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) WithContext(ctx context.Context) *DetailCurrentAPISessionCertificateParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) WithHTTPClient(client *http.Client) *DetailCurrentAPISessionCertificateParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithID adds the id to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) WithID(id string) *DetailCurrentAPISessionCertificateParams {
+	o.SetID(id)
+	return o
+}
+
+// SetID adds the id to the detail current Api session certificate params
+func (o *DetailCurrentAPISessionCertificateParams) SetID(id string) {
+	o.ID = id
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *DetailCurrentAPISessionCertificateParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	// path param id
+	if err := r.SetPathParam("id", o.ID); err != nil {
+		return err
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client/current_api_session/detail_current_api_session_certificate_responses.go

@@ -0,0 +1,171 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// DetailCurrentAPISessionCertificateReader is a Reader for the DetailCurrentAPISessionCertificate structure.
+type DetailCurrentAPISessionCertificateReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *DetailCurrentAPISessionCertificateReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewDetailCurrentAPISessionCertificateOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+	case 401:
+		result := NewDetailCurrentAPISessionCertificateUnauthorized()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+	case 404:
+		result := NewDetailCurrentAPISessionCertificateNotFound()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return nil, result
+
+	default:
+		return nil, runtime.NewAPIError("response status code does not match any response statuses defined for this endpoint in the swagger spec", response, response.Code())
+	}
+}
+
+// NewDetailCurrentAPISessionCertificateOK creates a DetailCurrentAPISessionCertificateOK with default headers values
+func NewDetailCurrentAPISessionCertificateOK() *DetailCurrentAPISessionCertificateOK {
+	return &DetailCurrentAPISessionCertificateOK{}
+}
+
+/*DetailCurrentAPISessionCertificateOK handles this case with default header values.
+
+A response containing a single API Session certificate
+*/
+type DetailCurrentAPISessionCertificateOK struct {
+	Payload *rest_model.DetailCurrentAPISessionCertificateEnvelope
+}
+
+func (o *DetailCurrentAPISessionCertificateOK) Error() string {
+	return fmt.Sprintf("[GET /current-api-session/certificates/{id}][%d] detailCurrentApiSessionCertificateOK  %+v", 200, o.Payload)
+}
+
+func (o *DetailCurrentAPISessionCertificateOK) GetPayload() *rest_model.DetailCurrentAPISessionCertificateEnvelope {
+	return o.Payload
+}
+
+func (o *DetailCurrentAPISessionCertificateOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.DetailCurrentAPISessionCertificateEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewDetailCurrentAPISessionCertificateUnauthorized creates a DetailCurrentAPISessionCertificateUnauthorized with default headers values
+func NewDetailCurrentAPISessionCertificateUnauthorized() *DetailCurrentAPISessionCertificateUnauthorized {
+	return &DetailCurrentAPISessionCertificateUnauthorized{}
+}
+
+/*DetailCurrentAPISessionCertificateUnauthorized handles this case with default header values.
+
+The currently supplied session does not have the correct access rights to request this resource
+*/
+type DetailCurrentAPISessionCertificateUnauthorized struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *DetailCurrentAPISessionCertificateUnauthorized) Error() string {
+	return fmt.Sprintf("[GET /current-api-session/certificates/{id}][%d] detailCurrentApiSessionCertificateUnauthorized  %+v", 401, o.Payload)
+}
+
+func (o *DetailCurrentAPISessionCertificateUnauthorized) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *DetailCurrentAPISessionCertificateUnauthorized) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}
+
+// NewDetailCurrentAPISessionCertificateNotFound creates a DetailCurrentAPISessionCertificateNotFound with default headers values
+func NewDetailCurrentAPISessionCertificateNotFound() *DetailCurrentAPISessionCertificateNotFound {
+	return &DetailCurrentAPISessionCertificateNotFound{}
+}
+
+/*DetailCurrentAPISessionCertificateNotFound handles this case with default header values.
+
+The requested resource does not exist
+*/
+type DetailCurrentAPISessionCertificateNotFound struct {
+	Payload *rest_model.APIErrorEnvelope
+}
+
+func (o *DetailCurrentAPISessionCertificateNotFound) Error() string {
+	return fmt.Sprintf("[GET /current-api-session/certificates/{id}][%d] detailCurrentApiSessionCertificateNotFound  %+v", 404, o.Payload)
+}
+
+func (o *DetailCurrentAPISessionCertificateNotFound) GetPayload() *rest_model.APIErrorEnvelope {
+	return o.Payload
+}
+
+func (o *DetailCurrentAPISessionCertificateNotFound) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.APIErrorEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}

rest_client/current_api_session/list_current_api_session_certificates_parameters.go

@@ -0,0 +1,226 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	cr "github.com/go-openapi/runtime/client"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// NewListCurrentAPISessionCertificatesParams creates a new ListCurrentAPISessionCertificatesParams object
+// with the default values initialized.
+func NewListCurrentAPISessionCertificatesParams() *ListCurrentAPISessionCertificatesParams {
+	var ()
+	return &ListCurrentAPISessionCertificatesParams{
+
+		timeout: cr.DefaultTimeout,
+	}
+}
+
+// NewListCurrentAPISessionCertificatesParamsWithTimeout creates a new ListCurrentAPISessionCertificatesParams object
+// with the default values initialized, and the ability to set a timeout on a request
+func NewListCurrentAPISessionCertificatesParamsWithTimeout(timeout time.Duration) *ListCurrentAPISessionCertificatesParams {
+	var ()
+	return &ListCurrentAPISessionCertificatesParams{
+
+		timeout: timeout,
+	}
+}
+
+// NewListCurrentAPISessionCertificatesParamsWithContext creates a new ListCurrentAPISessionCertificatesParams object
+// with the default values initialized, and the ability to set a context for a request
+func NewListCurrentAPISessionCertificatesParamsWithContext(ctx context.Context) *ListCurrentAPISessionCertificatesParams {
+	var ()
+	return &ListCurrentAPISessionCertificatesParams{
+
+		Context: ctx,
+	}
+}
+
+// NewListCurrentAPISessionCertificatesParamsWithHTTPClient creates a new ListCurrentAPISessionCertificatesParams object
+// with the default values initialized, and the ability to set a custom HTTPClient for a request
+func NewListCurrentAPISessionCertificatesParamsWithHTTPClient(client *http.Client) *ListCurrentAPISessionCertificatesParams {
+	var ()
+	return &ListCurrentAPISessionCertificatesParams{
+		HTTPClient: client,
+	}
+}
+
+/*ListCurrentAPISessionCertificatesParams contains all the parameters to send to the API endpoint
+for the list current Api session certificates operation typically these are written to a http.Request
+*/
+type ListCurrentAPISessionCertificatesParams struct {
+
+	/*Filter*/
+	Filter *string
+	/*Limit*/
+	Limit *int64
+	/*Offset*/
+	Offset *int64
+
+	timeout    time.Duration
+	Context    context.Context
+	HTTPClient *http.Client
+}
+
+// WithTimeout adds the timeout to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) WithTimeout(timeout time.Duration) *ListCurrentAPISessionCertificatesParams {
+	o.SetTimeout(timeout)
+	return o
+}
+
+// SetTimeout adds the timeout to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) SetTimeout(timeout time.Duration) {
+	o.timeout = timeout
+}
+
+// WithContext adds the context to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) WithContext(ctx context.Context) *ListCurrentAPISessionCertificatesParams {
+	o.SetContext(ctx)
+	return o
+}
+
+// SetContext adds the context to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) SetContext(ctx context.Context) {
+	o.Context = ctx
+}
+
+// WithHTTPClient adds the HTTPClient to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) WithHTTPClient(client *http.Client) *ListCurrentAPISessionCertificatesParams {
+	o.SetHTTPClient(client)
+	return o
+}
+
+// SetHTTPClient adds the HTTPClient to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) SetHTTPClient(client *http.Client) {
+	o.HTTPClient = client
+}
+
+// WithFilter adds the filter to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) WithFilter(filter *string) *ListCurrentAPISessionCertificatesParams {
+	o.SetFilter(filter)
+	return o
+}
+
+// SetFilter adds the filter to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) SetFilter(filter *string) {
+	o.Filter = filter
+}
+
+// WithLimit adds the limit to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) WithLimit(limit *int64) *ListCurrentAPISessionCertificatesParams {
+	o.SetLimit(limit)
+	return o
+}
+
+// SetLimit adds the limit to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) SetLimit(limit *int64) {
+	o.Limit = limit
+}
+
+// WithOffset adds the offset to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) WithOffset(offset *int64) *ListCurrentAPISessionCertificatesParams {
+	o.SetOffset(offset)
+	return o
+}
+
+// SetOffset adds the offset to the list current Api session certificates params
+func (o *ListCurrentAPISessionCertificatesParams) SetOffset(offset *int64) {
+	o.Offset = offset
+}
+
+// WriteToRequest writes these params to a swagger request
+func (o *ListCurrentAPISessionCertificatesParams) WriteToRequest(r runtime.ClientRequest, reg strfmt.Registry) error {
+
+	if err := r.SetTimeout(o.timeout); err != nil {
+		return err
+	}
+	var res []error
+
+	if o.Filter != nil {
+
+		// query param filter
+		var qrFilter string
+		if o.Filter != nil {
+			qrFilter = *o.Filter
+		}
+		qFilter := qrFilter
+		if qFilter != "" {
+			if err := r.SetQueryParam("filter", qFilter); err != nil {
+				return err
+			}
+		}
+
+	}
+
+	if o.Limit != nil {
+
+		// query param limit
+		var qrLimit int64
+		if o.Limit != nil {
+			qrLimit = *o.Limit
+		}
+		qLimit := swag.FormatInt64(qrLimit)
+		if qLimit != "" {
+			if err := r.SetQueryParam("limit", qLimit); err != nil {
+				return err
+			}
+		}
+
+	}
+
+	if o.Offset != nil {
+
+		// query param offset
+		var qrOffset int64
+		if o.Offset != nil {
+			qrOffset = *o.Offset
+		}
+		qOffset := swag.FormatInt64(qrOffset)
+		if qOffset != "" {
+			if err := r.SetQueryParam("offset", qOffset); err != nil {
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_client/current_api_session/list_current_api_session_certificates_responses.go

@@ -0,0 +1,93 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/strfmt"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// ListCurrentAPISessionCertificatesReader is a Reader for the ListCurrentAPISessionCertificates structure.
+type ListCurrentAPISessionCertificatesReader struct {
+	formats strfmt.Registry
+}
+
+// ReadResponse reads a server response into the received o.
+func (o *ListCurrentAPISessionCertificatesReader) ReadResponse(response runtime.ClientResponse, consumer runtime.Consumer) (interface{}, error) {
+	switch response.Code() {
+	case 200:
+		result := NewListCurrentAPISessionCertificatesOK()
+		if err := result.readResponse(response, consumer, o.formats); err != nil {
+			return nil, err
+		}
+		return result, nil
+
+	default:
+		return nil, runtime.NewAPIError("response status code does not match any response statuses defined for this endpoint in the swagger spec", response, response.Code())
+	}
+}
+
+// NewListCurrentAPISessionCertificatesOK creates a ListCurrentAPISessionCertificatesOK with default headers values
+func NewListCurrentAPISessionCertificatesOK() *ListCurrentAPISessionCertificatesOK {
+	return &ListCurrentAPISessionCertificatesOK{}
+}
+
+/*ListCurrentAPISessionCertificatesOK handles this case with default header values.
+
+A list of the current API Session's certificate
+*/
+type ListCurrentAPISessionCertificatesOK struct {
+	Payload *rest_model.ListCurrentAPISessionCertificatesEnvelope
+}
+
+func (o *ListCurrentAPISessionCertificatesOK) Error() string {
+	return fmt.Sprintf("[GET /current-api-session/certificates][%d] listCurrentApiSessionCertificatesOK  %+v", 200, o.Payload)
+}
+
+func (o *ListCurrentAPISessionCertificatesOK) GetPayload() *rest_model.ListCurrentAPISessionCertificatesEnvelope {
+	return o.Payload
+}
+
+func (o *ListCurrentAPISessionCertificatesOK) readResponse(response runtime.ClientResponse, consumer runtime.Consumer, formats strfmt.Registry) error {
+
+	o.Payload = new(rest_model.ListCurrentAPISessionCertificatesEnvelope)
+
+	// response payload
+	if err := consumer.Consume(response.Body(), o.Payload); err != nil && err != io.EOF {
+		return err
+	}
+
+	return nil
+}

rest_model/create_current_api_session_certificate_envelope.go

@@ -0,0 +1,123 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// CreateCurrentAPISessionCertificateEnvelope create current Api session certificate envelope
+//
+// swagger:model createCurrentApiSessionCertificateEnvelope
+type CreateCurrentAPISessionCertificateEnvelope struct {
+
+	// data
+	// Required: true
+	Data *CurrentAPISessionCertificateCreateResponse `json:"data"`
+
+	// meta
+	// Required: true
+	Meta *Meta `json:"meta"`
+}
+
+// Validate validates this create current Api session certificate envelope
+func (m *CreateCurrentAPISessionCertificateEnvelope) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateData(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateMeta(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *CreateCurrentAPISessionCertificateEnvelope) validateData(formats strfmt.Registry) error {
+
+	if err := validate.Required("data", "body", m.Data); err != nil {
+		return err
+	}
+
+	if m.Data != nil {
+		if err := m.Data.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("data")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *CreateCurrentAPISessionCertificateEnvelope) validateMeta(formats strfmt.Registry) error {
+
+	if err := validate.Required("meta", "body", m.Meta); err != nil {
+		return err
+	}
+
+	if m.Meta != nil {
+		if err := m.Meta.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("meta")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *CreateCurrentAPISessionCertificateEnvelope) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *CreateCurrentAPISessionCertificateEnvelope) UnmarshalBinary(b []byte) error {
+	var res CreateCurrentAPISessionCertificateEnvelope
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

rest_model/current_api_session_certificate_create.go

@@ -0,0 +1,88 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// CurrentAPISessionCertificateCreate current Api session certificate create
+//
+// swagger:model currentApiSessionCertificateCreate
+type CurrentAPISessionCertificateCreate struct {
+
+	// csr
+	// Required: true
+	Csr *string `json:"csr"`
+}
+
+// Validate validates this current Api session certificate create
+func (m *CurrentAPISessionCertificateCreate) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateCsr(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateCreate) validateCsr(formats strfmt.Registry) error {
+
+	if err := validate.Required("csr", "body", m.Csr); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *CurrentAPISessionCertificateCreate) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *CurrentAPISessionCertificateCreate) UnmarshalBinary(b []byte) error {
+	var res CurrentAPISessionCertificateCreate
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

rest_model/current_api_session_certificate_create_response.go

@@ -0,0 +1,150 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// CurrentAPISessionCertificateCreateResponse current Api session certificate create response
+//
+// swagger:model currentApiSessionCertificateCreateResponse
+type CurrentAPISessionCertificateCreateResponse struct {
+	CreateLocation
+
+	// cas
+	Cas string `json:"cas,omitempty"`
+
+	// certificate
+	// Required: true
+	Certificate *string `json:"certificate"`
+}
+
+// UnmarshalJSON unmarshals this object from a JSON structure
+func (m *CurrentAPISessionCertificateCreateResponse) UnmarshalJSON(raw []byte) error {
+	// AO0
+	var aO0 CreateLocation
+	if err := swag.ReadJSON(raw, &aO0); err != nil {
+		return err
+	}
+	m.CreateLocation = aO0
+
+	// AO1
+	var dataAO1 struct {
+		Cas string `json:"cas,omitempty"`
+
+		Certificate *string `json:"certificate"`
+	}
+	if err := swag.ReadJSON(raw, &dataAO1); err != nil {
+		return err
+	}
+
+	m.Cas = dataAO1.Cas
+
+	m.Certificate = dataAO1.Certificate
+
+	return nil
+}
+
+// MarshalJSON marshals this object to a JSON structure
+func (m CurrentAPISessionCertificateCreateResponse) MarshalJSON() ([]byte, error) {
+	_parts := make([][]byte, 0, 2)
+
+	aO0, err := swag.WriteJSON(m.CreateLocation)
+	if err != nil {
+		return nil, err
+	}
+	_parts = append(_parts, aO0)
+	var dataAO1 struct {
+		Cas string `json:"cas,omitempty"`
+
+		Certificate *string `json:"certificate"`
+	}
+
+	dataAO1.Cas = m.Cas
+
+	dataAO1.Certificate = m.Certificate
+
+	jsonDataAO1, errAO1 := swag.WriteJSON(dataAO1)
+	if errAO1 != nil {
+		return nil, errAO1
+	}
+	_parts = append(_parts, jsonDataAO1)
+	return swag.ConcatJSON(_parts...), nil
+}
+
+// Validate validates this current Api session certificate create response
+func (m *CurrentAPISessionCertificateCreateResponse) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	// validation for a type composition with CreateLocation
+	if err := m.CreateLocation.Validate(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateCertificate(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateCreateResponse) validateCertificate(formats strfmt.Registry) error {
+
+	if err := validate.Required("certificate", "body", m.Certificate); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *CurrentAPISessionCertificateCreateResponse) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *CurrentAPISessionCertificateCreateResponse) UnmarshalBinary(b []byte) error {
+	var res CurrentAPISessionCertificateCreateResponse
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

rest_model/current_api_session_certificate_detail.go

@@ -0,0 +1,249 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// CurrentAPISessionCertificateDetail current Api session certificate detail
+//
+// swagger:model currentApiSessionCertificateDetail
+type CurrentAPISessionCertificateDetail struct {
+	BaseEntity
+
+	// certificate
+	// Required: true
+	Certificate *string `json:"certificate"`
+
+	// fingerprint
+	// Required: true
+	Fingerprint *string `json:"fingerprint"`
+
+	// subject
+	// Required: true
+	Subject *string `json:"subject"`
+
+	// valid from
+	// Required: true
+	// Format: date-time
+	ValidFrom *strfmt.DateTime `json:"validFrom"`
+
+	// valid to
+	// Required: true
+	// Format: date-time
+	ValidTo *strfmt.DateTime `json:"validTo"`
+}
+
+// UnmarshalJSON unmarshals this object from a JSON structure
+func (m *CurrentAPISessionCertificateDetail) UnmarshalJSON(raw []byte) error {
+	// AO0
+	var aO0 BaseEntity
+	if err := swag.ReadJSON(raw, &aO0); err != nil {
+		return err
+	}
+	m.BaseEntity = aO0
+
+	// AO1
+	var dataAO1 struct {
+		Certificate *string `json:"certificate"`
+
+		Fingerprint *string `json:"fingerprint"`
+
+		Subject *string `json:"subject"`
+
+		ValidFrom *strfmt.DateTime `json:"validFrom"`
+
+		ValidTo *strfmt.DateTime `json:"validTo"`
+	}
+	if err := swag.ReadJSON(raw, &dataAO1); err != nil {
+		return err
+	}
+
+	m.Certificate = dataAO1.Certificate
+
+	m.Fingerprint = dataAO1.Fingerprint
+
+	m.Subject = dataAO1.Subject
+
+	m.ValidFrom = dataAO1.ValidFrom
+
+	m.ValidTo = dataAO1.ValidTo
+
+	return nil
+}
+
+// MarshalJSON marshals this object to a JSON structure
+func (m CurrentAPISessionCertificateDetail) MarshalJSON() ([]byte, error) {
+	_parts := make([][]byte, 0, 2)
+
+	aO0, err := swag.WriteJSON(m.BaseEntity)
+	if err != nil {
+		return nil, err
+	}
+	_parts = append(_parts, aO0)
+	var dataAO1 struct {
+		Certificate *string `json:"certificate"`
+
+		Fingerprint *string `json:"fingerprint"`
+
+		Subject *string `json:"subject"`
+
+		ValidFrom *strfmt.DateTime `json:"validFrom"`
+
+		ValidTo *strfmt.DateTime `json:"validTo"`
+	}
+
+	dataAO1.Certificate = m.Certificate
+
+	dataAO1.Fingerprint = m.Fingerprint
+
+	dataAO1.Subject = m.Subject
+
+	dataAO1.ValidFrom = m.ValidFrom
+
+	dataAO1.ValidTo = m.ValidTo
+
+	jsonDataAO1, errAO1 := swag.WriteJSON(dataAO1)
+	if errAO1 != nil {
+		return nil, errAO1
+	}
+	_parts = append(_parts, jsonDataAO1)
+	return swag.ConcatJSON(_parts...), nil
+}
+
+// Validate validates this current Api session certificate detail
+func (m *CurrentAPISessionCertificateDetail) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	// validation for a type composition with BaseEntity
+	if err := m.BaseEntity.Validate(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateCertificate(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateFingerprint(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateSubject(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateValidFrom(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateValidTo(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateDetail) validateCertificate(formats strfmt.Registry) error {
+
+	if err := validate.Required("certificate", "body", m.Certificate); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateDetail) validateFingerprint(formats strfmt.Registry) error {
+
+	if err := validate.Required("fingerprint", "body", m.Fingerprint); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateDetail) validateSubject(formats strfmt.Registry) error {
+
+	if err := validate.Required("subject", "body", m.Subject); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateDetail) validateValidFrom(formats strfmt.Registry) error {
+
+	if err := validate.Required("validFrom", "body", m.ValidFrom); err != nil {
+		return err
+	}
+
+	if err := validate.FormatOf("validFrom", "body", "date-time", m.ValidFrom.String(), formats); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (m *CurrentAPISessionCertificateDetail) validateValidTo(formats strfmt.Registry) error {
+
+	if err := validate.Required("validTo", "body", m.ValidTo); err != nil {
+		return err
+	}
+
+	if err := validate.FormatOf("validTo", "body", "date-time", m.ValidTo.String(), formats); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *CurrentAPISessionCertificateDetail) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *CurrentAPISessionCertificateDetail) UnmarshalBinary(b []byte) error {
+	var res CurrentAPISessionCertificateDetail
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

rest_model/current_api_session_certificate_list.go

@@ -0,0 +1,69 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"strconv"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// CurrentAPISessionCertificateList current Api session certificate list
+//
+// swagger:model currentApiSessionCertificateList
+type CurrentAPISessionCertificateList []*CurrentAPISessionCertificateDetail
+
+// Validate validates this current Api session certificate list
+func (m CurrentAPISessionCertificateList) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	for i := 0; i < len(m); i++ {
+		if swag.IsZero(m[i]) { // not required
+			continue
+		}
+
+		if m[i] != nil {
+			if err := m[i].Validate(formats); err != nil {
+				if ve, ok := err.(*errors.Validation); ok {
+					return ve.ValidateName(strconv.Itoa(i))
+				}
+				return err
+			}
+		}
+
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_model/detail_current_api_session_certificate_envelope.go

@@ -0,0 +1,123 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// DetailCurrentAPISessionCertificateEnvelope detail current Api session certificate envelope
+//
+// swagger:model detailCurrentApiSessionCertificateEnvelope
+type DetailCurrentAPISessionCertificateEnvelope struct {
+
+	// data
+	// Required: true
+	Data *CurrentAPISessionCertificateDetail `json:"data"`
+
+	// meta
+	// Required: true
+	Meta *Meta `json:"meta"`
+}
+
+// Validate validates this detail current Api session certificate envelope
+func (m *DetailCurrentAPISessionCertificateEnvelope) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateData(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateMeta(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *DetailCurrentAPISessionCertificateEnvelope) validateData(formats strfmt.Registry) error {
+
+	if err := validate.Required("data", "body", m.Data); err != nil {
+		return err
+	}
+
+	if m.Data != nil {
+		if err := m.Data.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("data")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *DetailCurrentAPISessionCertificateEnvelope) validateMeta(formats strfmt.Registry) error {
+
+	if err := validate.Required("meta", "body", m.Meta); err != nil {
+		return err
+	}
+
+	if m.Meta != nil {
+		if err := m.Meta.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("meta")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *DetailCurrentAPISessionCertificateEnvelope) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *DetailCurrentAPISessionCertificateEnvelope) UnmarshalBinary(b []byte) error {
+	var res DetailCurrentAPISessionCertificateEnvelope
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

rest_model/list_current_api_session_certificates_envelope.go

@@ -0,0 +1,121 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package rest_model
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+	"github.com/go-openapi/validate"
+)
+
+// ListCurrentAPISessionCertificatesEnvelope list current API session certificates envelope
+//
+// swagger:model listCurrentAPISessionCertificatesEnvelope
+type ListCurrentAPISessionCertificatesEnvelope struct {
+
+	// data
+	// Required: true
+	Data CurrentAPISessionCertificateList `json:"data"`
+
+	// meta
+	// Required: true
+	Meta *Meta `json:"meta"`
+}
+
+// Validate validates this list current API session certificates envelope
+func (m *ListCurrentAPISessionCertificatesEnvelope) Validate(formats strfmt.Registry) error {
+	var res []error
+
+	if err := m.validateData(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if err := m.validateMeta(formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+func (m *ListCurrentAPISessionCertificatesEnvelope) validateData(formats strfmt.Registry) error {
+
+	if err := validate.Required("data", "body", m.Data); err != nil {
+		return err
+	}
+
+	if err := m.Data.Validate(formats); err != nil {
+		if ve, ok := err.(*errors.Validation); ok {
+			return ve.ValidateName("data")
+		}
+		return err
+	}
+
+	return nil
+}
+
+func (m *ListCurrentAPISessionCertificatesEnvelope) validateMeta(formats strfmt.Registry) error {
+
+	if err := validate.Required("meta", "body", m.Meta); err != nil {
+		return err
+	}
+
+	if m.Meta != nil {
+		if err := m.Meta.Validate(formats); err != nil {
+			if ve, ok := err.(*errors.Validation); ok {
+				return ve.ValidateName("meta")
+			}
+			return err
+		}
+	}
+
+	return nil
+}
+
+// MarshalBinary interface implementation
+func (m *ListCurrentAPISessionCertificatesEnvelope) MarshalBinary() ([]byte, error) {
+	if m == nil {
+		return nil, nil
+	}
+	return swag.WriteJSON(m)
+}
+
+// UnmarshalBinary interface implementation
+func (m *ListCurrentAPISessionCertificatesEnvelope) UnmarshalBinary(b []byte) error {
+	var res ListCurrentAPISessionCertificatesEnvelope
+	if err := swag.ReadJSON(b, &res); err != nil {
+		return err
+	}
+	*m = res
+	return nil
+}

rest_server/configure_ziti_edge.go

@@ -159,6 +159,11 @@ func configureAPI(api *operations.ZitiEdgeAPI) http.Handler {
 			return middleware.NotImplemented("operation config.CreateConfigType has not yet been implemented")
 		})
 	}
+	if api.CurrentAPISessionCreateCurrentAPISessionCertificateHandler == nil {
+		api.CurrentAPISessionCreateCurrentAPISessionCertificateHandler = current_api_session.CreateCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.CreateCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.CreateCurrentAPISessionCertificate has not yet been implemented")
+		})
+	}
 	if api.DatabaseCreateDatabaseSnapshotHandler == nil {
 		api.DatabaseCreateDatabaseSnapshotHandler = database.CreateDatabaseSnapshotHandlerFunc(func(params database.CreateDatabaseSnapshotParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation database.CreateDatabaseSnapshot has not yet been implemented")
@@ -244,6 +249,11 @@ func configureAPI(api *operations.ZitiEdgeAPI) http.Handler {
 			return middleware.NotImplemented("operation config.DeleteConfigType has not yet been implemented")
 		})
 	}
+	if api.CurrentAPISessionDeleteCurrentAPISessionCertificateHandler == nil {
+		api.CurrentAPISessionDeleteCurrentAPISessionCertificateHandler = current_api_session.DeleteCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.DeleteCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.DeleteCurrentAPISessionCertificate has not yet been implemented")
+		})
+	}
 	if api.EdgeRouterDeleteEdgeRouterHandler == nil {
 		api.EdgeRouterDeleteEdgeRouterHandler = edge_router.DeleteEdgeRouterHandlerFunc(func(params edge_router.DeleteEdgeRouterParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation edge_router.DeleteEdgeRouter has not yet been implemented")
@@ -324,6 +334,11 @@ func configureAPI(api *operations.ZitiEdgeAPI) http.Handler {
 			return middleware.NotImplemented("operation config.DetailConfigType has not yet been implemented")
 		})
 	}
+	if api.CurrentAPISessionDetailCurrentAPISessionCertificateHandler == nil {
+		api.CurrentAPISessionDetailCurrentAPISessionCertificateHandler = current_api_session.DetailCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.DetailCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.DetailCurrentAPISessionCertificate has not yet been implemented")
+		})
+	}
 	if api.CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler == nil {
 		api.CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler = current_api_session.DetailCurrentIdentityAuthenticatorHandlerFunc(func(params current_api_session.DetailCurrentIdentityAuthenticatorParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation current_api_session.DetailCurrentIdentityAuthenticator has not yet been implemented")
@@ -504,6 +519,11 @@ func configureAPI(api *operations.ZitiEdgeAPI) http.Handler {
 			return middleware.NotImplemented("operation config.ListConfigsForConfigType has not yet been implemented")
 		})
 	}
+	if api.CurrentAPISessionListCurrentAPISessionCertificatesHandler == nil {
+		api.CurrentAPISessionListCurrentAPISessionCertificatesHandler = current_api_session.ListCurrentAPISessionCertificatesHandlerFunc(func(params current_api_session.ListCurrentAPISessionCertificatesParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.ListCurrentAPISessionCertificates has not yet been implemented")
+		})
+	}
 	if api.CurrentAPISessionListCurrentIdentityAuthenticatorsHandler == nil {
 		api.CurrentAPISessionListCurrentIdentityAuthenticatorsHandler = current_api_session.ListCurrentIdentityAuthenticatorsHandlerFunc(func(params current_api_session.ListCurrentIdentityAuthenticatorsParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation current_api_session.ListCurrentIdentityAuthenticators has not yet been implemented")

rest_server/embedded_spec.go

@@ -1154,7 +1154,7 @@ func init() {
         ],
         "description": "Terminates the current API session",
         "tags": [
-          "CurrentAPI Session"
+          "Current API Session"
         ],
         "summary": "Logout",
         "responses": {
@@ -1167,6 +1167,127 @@ func init() {
         }
       }
     },
+    "/current-api-session/certificates": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Retrieves a list of certificate resources for the current API session; supports filtering, sorting, and pagination",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "List the ephemeral certificates available for the current API Session",
+        "operationId": "listCurrentApiSessionCertificates",
+        "parameters": [
+          {
+            "$ref": "#/parameters/limit"
+          },
+          {
+            "$ref": "#/parameters/offset"
+          },
+          {
+            "$ref": "#/parameters/filter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/listCurrentApiSessionCertificates"
+          }
+        }
+      },
+      "post": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Creates an ephemeral certificate for the current API Session. This endpoint expects a PEM encoded CSRs to be provided for fulfillment as a property of a JSON payload. It is up to the client to manage the private key backing the CSR request.",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "Creates an ephemeral certificate for the current API Session",
+        "operationId": "createCurrentApiSessionCertificate",
+        "parameters": [
+          {
+            "description": "The payload describing the CSR used to create a session certificate",
+            "name": "Body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/currentApiSessionCertificateCreate"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/createCurrentApiSessionCertificateResponse"
+          },
+          "400": {
+            "$ref": "#/responses/badRequestResponse"
+          },
+          "401": {
+            "$ref": "#/responses/unauthorizedResponse"
+          }
+        }
+      }
+    },
+    "/current-api-session/certificates/{id}": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Retrieves a single ephemeral certificate by id",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "Retrieves an ephemeral certificate",
+        "operationId": "detailCurrentApiSessionCertificate",
+        "responses": {
+          "200": {
+            "$ref": "#/responses/detailCurrentApiSessionCertificate"
+          },
+          "401": {
+            "$ref": "#/responses/unauthorizedResponse"
+          },
+          "404": {
+            "$ref": "#/responses/notFoundResponse"
+          }
+        }
+      },
+      "delete": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Delete an ephemeral certificateby id\n",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "Delete an ephemeral certificate",
+        "operationId": "deleteCurrentApiSessionCertificate",
+        "responses": {
+          "200": {
+            "$ref": "#/responses/deleteResponse"
+          },
+          "400": {
+            "$ref": "#/responses/badRequestResponse"
+          },
+          "401": {
+            "$ref": "#/responses/unauthorizedResponse"
+          }
+        }
+      },
+      "parameters": [
+        {
+          "$ref": "#/parameters/id"
+        }
+      ]
+    },
     "/current-identity": {
       "get": {
         "security": [
@@ -6290,6 +6411,20 @@ func init() {
         "name": "example-config-name"
       }
     },
+    "createCurrentApiSessionCertificateEnvelope": {
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/currentApiSessionCertificateCreateResponse"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
     "createEnvelope": {
       "type": "object",
       "properties": {
@@ -6327,6 +6462,81 @@ func init() {
         }
       }
     },
+    "currentApiSessionCertificateCreate": {
+      "type": "object",
+      "required": [
+        "csr"
+      ],
+      "properties": {
+        "csr": {
+          "type": "string"
+        }
+      }
+    },
+    "currentApiSessionCertificateCreateResponse": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/createLocation"
+        },
+        {
+          "type": "object",
+          "required": [
+            "certificate"
+          ],
+          "properties": {
+            "cas": {
+              "type": "string"
+            },
+            "certificate": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "currentApiSessionCertificateDetail": {
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "#/definitions/baseEntity"
+        },
+        {
+          "type": "object",
+          "required": [
+            "subject",
+            "fingerprint",
+            "validFrom",
+            "validTo",
+            "certificate"
+          ],
+          "properties": {
+            "certificate": {
+              "type": "string"
+            },
+            "fingerprint": {
+              "type": "string"
+            },
+            "subject": {
+              "type": "string"
+            },
+            "validFrom": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "validTo": {
+              "type": "string",
+              "format": "date-time"
+            }
+          }
+        }
+      ]
+    },
+    "currentApiSessionCertificateList": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/currentApiSessionCertificateDetail"
+      }
+    },
     "currentApiSessionDetail": {
       "description": "An API Session object for the current API session",
       "type": "object",
@@ -6474,6 +6684,20 @@ func init() {
         }
       }
     },
+    "detailCurrentApiSessionCertificateEnvelope": {
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/currentApiSessionCertificateDetail"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
     "detailEdgeRouterPolicyEnvelope": {
       "type": "object",
       "required": [
@@ -7579,6 +7803,20 @@ func init() {
         }
       }
     },
+    "listCurrentAPISessionCertificatesEnvelope": {
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/currentApiSessionCertificateList"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
     "listEdgeRouterPoliciesEnvelope": {
       "type": "object",
       "required": [
@@ -9313,6 +9551,12 @@ func init() {
         }
       }
     },
+    "createCurrentApiSessionCertificateResponse": {
+      "description": "A response of a create API Session certificate",
+      "schema": {
+        "$ref": "#/definitions/createCurrentApiSessionCertificateEnvelope"
+      }
+    },
     "createResponse": {
       "description": "The create request was successful and the resource has been added at the following location",
       "schema": {
@@ -9403,6 +9647,12 @@ func init() {
         }
       }
     },
+    "detailCurrentApiSessionCertificate": {
+      "description": "A response containing a single API Session certificate",
+      "schema": {
+        "$ref": "#/definitions/detailCurrentApiSessionCertificateEnvelope"
+      }
+    },
     "detailCurrentIdentity": {
       "description": "The identity associated with the API Session used to issue the request",
       "schema": {
@@ -9627,6 +9877,12 @@ func init() {
         "$ref": "#/definitions/listConfigsEnvelope"
       }
     },
+    "listCurrentApiSessionCertificates": {
+      "description": "A list of the current API Session's certificate",
+      "schema": {
+        "$ref": "#/definitions/listCurrentAPISessionCertificatesEnvelope"
+      }
+    },
     "listEdgeRouterPolicies": {
       "description": "A list of edge router policies",
       "schema": {
@@ -12788,7 +13044,7 @@ func init() {
         ],
         "description": "Terminates the current API session",
         "tags": [
-          "CurrentAPI Session"
+          "Current API Session"
         ],
         "summary": "Logout",
         "responses": {
@@ -12825,6 +13081,303 @@ func init() {
         }
       }
     },
+    "/current-api-session/certificates": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Retrieves a list of certificate resources for the current API session; supports filtering, sorting, and pagination",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "List the ephemeral certificates available for the current API Session",
+        "operationId": "listCurrentApiSessionCertificates",
+        "parameters": [
+          {
+            "type": "integer",
+            "name": "limit",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "name": "offset",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "filter",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "A list of the current API Session's certificate",
+            "schema": {
+              "$ref": "#/definitions/listCurrentAPISessionCertificatesEnvelope"
+            }
+          }
+        }
+      },
+      "post": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Creates an ephemeral certificate for the current API Session. This endpoint expects a PEM encoded CSRs to be provided for fulfillment as a property of a JSON payload. It is up to the client to manage the private key backing the CSR request.",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "Creates an ephemeral certificate for the current API Session",
+        "operationId": "createCurrentApiSessionCertificate",
+        "parameters": [
+          {
+            "description": "The payload describing the CSR used to create a session certificate",
+            "name": "Body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/currentApiSessionCertificateCreate"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "A response of a create API Session certificate",
+            "schema": {
+              "$ref": "#/definitions/createCurrentApiSessionCertificateEnvelope"
+            }
+          },
+          "400": {
+            "description": "The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": {
+                    "details": {
+                      "context": "(root)",
+                      "field": "(root)",
+                      "property": "fooField3"
+                    },
+                    "field": "(root)",
+                    "message": "(root): fooField3 is required",
+                    "type": "required",
+                    "value": {
+                      "fooField": "abc",
+                      "fooField2": "def"
+                    }
+                  },
+                  "causeMessage": "schema validation failed",
+                  "code": "COULD_NOT_VALIDATE",
+                  "message": "The supplied request contains an invalid document",
+                  "requestId": "ac6766d6-3a09-44b3-8d8a-1b541d97fdd9"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/current-api-session/certificates/{id}": {
+      "get": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Retrieves a single ephemeral certificate by id",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "Retrieves an ephemeral certificate",
+        "operationId": "detailCurrentApiSessionCertificate",
+        "responses": {
+          "200": {
+            "description": "A response containing a single API Session certificate",
+            "schema": {
+              "$ref": "#/definitions/detailCurrentApiSessionCertificateEnvelope"
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "The requested resource does not exist",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {
+                      "id": "71a3000f-7dda-491a-9b90-a19f4ee6c406"
+                    }
+                  },
+                  "cause": null,
+                  "causeMessage": "",
+                  "code": "NOT_FOUND",
+                  "message": "The resource requested was not found or is no longer available",
+                  "requestId": "270908d6-f2ef-4577-b973-67bec18ae376"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "security": [
+          {
+            "ztSession": []
+          }
+        ],
+        "description": "Delete an ephemeral certificateby id\n",
+        "tags": [
+          "Current API Session"
+        ],
+        "summary": "Delete an ephemeral certificate",
+        "operationId": "deleteCurrentApiSessionCertificate",
+        "responses": {
+          "200": {
+            "description": "The delete request was successful and the resource has been removed",
+            "schema": {
+              "$ref": "#/definitions/empty"
+            }
+          },
+          "400": {
+            "description": "The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": {
+                    "details": {
+                      "context": "(root)",
+                      "field": "(root)",
+                      "property": "fooField3"
+                    },
+                    "field": "(root)",
+                    "message": "(root): fooField3 is required",
+                    "type": "required",
+                    "value": {
+                      "fooField": "abc",
+                      "fooField2": "def"
+                    }
+                  },
+                  "causeMessage": "schema validation failed",
+                  "code": "COULD_NOT_VALIDATE",
+                  "message": "The supplied request contains an invalid document",
+                  "requestId": "ac6766d6-3a09-44b3-8d8a-1b541d97fdd9"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The currently supplied session does not have the correct access rights to request this resource",
+            "schema": {
+              "$ref": "#/definitions/apiErrorEnvelope"
+            },
+            "examples": {
+              "application/json": {
+                "error": {
+                  "args": {
+                    "urlVars": {}
+                  },
+                  "cause": "",
+                  "causeMessage": "",
+                  "code": "UNAUTHORIZED",
+                  "message": "The request could not be completed. The session is not authorized or the credentials are invalid",
+                  "requestId": "0bfe7a04-9229-4b7a-812c-9eb3cc0eac0f"
+                },
+                "meta": {
+                  "apiEnrolmentVersion": "0.0.1",
+                  "apiVersion": "0.0.1"
+                }
+              }
+            }
+          }
+        }
+      },
+      "parameters": [
+        {
+          "type": "string",
+          "description": "The id of the requested resource",
+          "name": "id",
+          "in": "path",
+          "required": true
+        }
+      ]
+    },
     "/current-identity": {
       "get": {
         "security": [
@@ -24052,6 +24605,20 @@ func init() {
         "name": "example-config-name"
       }
     },
+    "createCurrentApiSessionCertificateEnvelope": {
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/currentApiSessionCertificateCreateResponse"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
     "createEnvelope": {
       "type": "object",
       "properties": {
@@ -24089,6 +24656,81 @@ func init() {
         }
       }
     },
+    "currentApiSessionCertificateCreate": {
+      "type": "object",
+      "required": [
+        "csr"
+      ],
+      "properties": {
+        "csr": {
+          "type": "string"
+        }
+      }
+    },
+    "currentApiSessionCertificateCreateResponse": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/createLocation"
+        },
+        {
+          "type": "object",
+          "required": [
+            "certificate"
+          ],
+          "properties": {
+            "cas": {
+              "type": "string"
+            },
+            "certificate": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "currentApiSessionCertificateDetail": {
+      "type": "object",
+      "allOf": [
+        {
+          "$ref": "#/definitions/baseEntity"
+        },
+        {
+          "type": "object",
+          "required": [
+            "subject",
+            "fingerprint",
+            "validFrom",
+            "validTo",
+            "certificate"
+          ],
+          "properties": {
+            "certificate": {
+              "type": "string"
+            },
+            "fingerprint": {
+              "type": "string"
+            },
+            "subject": {
+              "type": "string"
+            },
+            "validFrom": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "validTo": {
+              "type": "string",
+              "format": "date-time"
+            }
+          }
+        }
+      ]
+    },
+    "currentApiSessionCertificateList": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/currentApiSessionCertificateDetail"
+      }
+    },
     "currentApiSessionDetail": {
       "description": "An API Session object for the current API session",
       "type": "object",
@@ -24236,6 +24878,20 @@ func init() {
         }
       }
     },
+    "detailCurrentApiSessionCertificateEnvelope": {
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/currentApiSessionCertificateDetail"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
     "detailEdgeRouterPolicyEnvelope": {
       "type": "object",
       "required": [
@@ -25341,6 +25997,20 @@ func init() {
         }
       }
     },
+    "listCurrentAPISessionCertificatesEnvelope": {
+      "required": [
+        "meta",
+        "data"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/currentApiSessionCertificateList"
+        },
+        "meta": {
+          "$ref": "#/definitions/meta"
+        }
+      }
+    },
     "listEdgeRouterPoliciesEnvelope": {
       "type": "object",
       "required": [
@@ -27076,6 +27746,12 @@ func init() {
         }
       }
     },
+    "createCurrentApiSessionCertificateResponse": {
+      "description": "A response of a create API Session certificate",
+      "schema": {
+        "$ref": "#/definitions/createCurrentApiSessionCertificateEnvelope"
+      }
+    },
     "createResponse": {
       "description": "The create request was successful and the resource has been added at the following location",
       "schema": {
@@ -27166,6 +27842,12 @@ func init() {
         }
       }
     },
+    "detailCurrentApiSessionCertificate": {
+      "description": "A response containing a single API Session certificate",
+      "schema": {
+        "$ref": "#/definitions/detailCurrentApiSessionCertificateEnvelope"
+      }
+    },
     "detailCurrentIdentity": {
       "description": "The identity associated with the API Session used to issue the request",
       "schema": {
@@ -27390,6 +28072,12 @@ func init() {
         "$ref": "#/definitions/listConfigsEnvelope"
       }
     },
+    "listCurrentApiSessionCertificates": {
+      "description": "A list of the current API Session's certificate",
+      "schema": {
+        "$ref": "#/definitions/listCurrentAPISessionCertificatesEnvelope"
+      }
+    },
     "listEdgeRouterPolicies": {
       "description": "A list of edge router policies",
       "schema": {

rest_server/operations/current_api_session/create_current_api_session_certificate.go

@@ -0,0 +1,97 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// CreateCurrentAPISessionCertificateHandlerFunc turns a function with the right signature into a create current Api session certificate handler
+type CreateCurrentAPISessionCertificateHandlerFunc func(CreateCurrentAPISessionCertificateParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn CreateCurrentAPISessionCertificateHandlerFunc) Handle(params CreateCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// CreateCurrentAPISessionCertificateHandler interface for that can handle valid create current Api session certificate params
+type CreateCurrentAPISessionCertificateHandler interface {
+	Handle(CreateCurrentAPISessionCertificateParams, interface{}) middleware.Responder
+}
+
+// NewCreateCurrentAPISessionCertificate creates a new http.Handler for the create current Api session certificate operation
+func NewCreateCurrentAPISessionCertificate(ctx *middleware.Context, handler CreateCurrentAPISessionCertificateHandler) *CreateCurrentAPISessionCertificate {
+	return &CreateCurrentAPISessionCertificate{Context: ctx, Handler: handler}
+}
+
+/*CreateCurrentAPISessionCertificate swagger:route POST /current-api-session/certificates Current API Session createCurrentApiSessionCertificate
+
+Creates an ephemeral certificate for the current API Session
+
+Creates an ephemeral certificate for the current API Session. This endpoint expects a PEM encoded CSRs to be provided for fulfillment as a property of a JSON payload. It is up to the client to manage the private key backing the CSR request.
+
+*/
+type CreateCurrentAPISessionCertificate struct {
+	Context *middleware.Context
+	Handler CreateCurrentAPISessionCertificateHandler
+}
+
+func (o *CreateCurrentAPISessionCertificate) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		r = rCtx
+	}
+	var Params = NewCreateCurrentAPISessionCertificateParams()
+
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		r = aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}

rest_server/operations/current_api_session/create_current_api_session_certificate_parameters.go

@@ -0,0 +1,101 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"io"
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// NewCreateCurrentAPISessionCertificateParams creates a new CreateCurrentAPISessionCertificateParams object
+// no default values defined in spec.
+func NewCreateCurrentAPISessionCertificateParams() CreateCurrentAPISessionCertificateParams {
+
+	return CreateCurrentAPISessionCertificateParams{}
+}
+
+// CreateCurrentAPISessionCertificateParams contains all the bound params for the create current Api session certificate operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters createCurrentApiSessionCertificate
+type CreateCurrentAPISessionCertificateParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*The payload describing the CSR used to create a session certificate
+	  Required: true
+	  In: body
+	*/
+	Body *rest_model.CurrentAPISessionCertificateCreate
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewCreateCurrentAPISessionCertificateParams() beforehand.
+func (o *CreateCurrentAPISessionCertificateParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	if runtime.HasBody(r) {
+		defer r.Body.Close()
+		var body rest_model.CurrentAPISessionCertificateCreate
+		if err := route.Consumer.Consume(r.Body, &body); err != nil {
+			if err == io.EOF {
+				res = append(res, errors.Required("body", "body", ""))
+			} else {
+				res = append(res, errors.NewParseError("body", "body", "", err))
+			}
+		} else {
+			// validate body object
+			if err := body.Validate(route.Formats); err != nil {
+				res = append(res, err)
+			}
+
+			if len(res) == 0 {
+				o.Body = &body
+			}
+		}
+	} else {
+		res = append(res, errors.Required("body", "body", ""))
+	}
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}

rest_server/operations/current_api_session/create_current_api_session_certificate_responses.go

@@ -0,0 +1,170 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// CreateCurrentAPISessionCertificateOKCode is the HTTP code returned for type CreateCurrentAPISessionCertificateOK
+const CreateCurrentAPISessionCertificateOKCode int = 200
+
+/*CreateCurrentAPISessionCertificateOK A response of a create API Session certificate
+
+swagger:response createCurrentApiSessionCertificateOK
+*/
+type CreateCurrentAPISessionCertificateOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.CreateCurrentAPISessionCertificateEnvelope `json:"body,omitempty"`
+}
+
+// NewCreateCurrentAPISessionCertificateOK creates CreateCurrentAPISessionCertificateOK with default headers values
+func NewCreateCurrentAPISessionCertificateOK() *CreateCurrentAPISessionCertificateOK {
+
+	return &CreateCurrentAPISessionCertificateOK{}
+}
+
+// WithPayload adds the payload to the create current Api session certificate o k response
+func (o *CreateCurrentAPISessionCertificateOK) WithPayload(payload *rest_model.CreateCurrentAPISessionCertificateEnvelope) *CreateCurrentAPISessionCertificateOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the create current Api session certificate o k response
+func (o *CreateCurrentAPISessionCertificateOK) SetPayload(payload *rest_model.CreateCurrentAPISessionCertificateEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *CreateCurrentAPISessionCertificateOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// CreateCurrentAPISessionCertificateBadRequestCode is the HTTP code returned for type CreateCurrentAPISessionCertificateBadRequest
+const CreateCurrentAPISessionCertificateBadRequestCode int = 400
+
+/*CreateCurrentAPISessionCertificateBadRequest The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
+
+swagger:response createCurrentApiSessionCertificateBadRequest
+*/
+type CreateCurrentAPISessionCertificateBadRequest struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewCreateCurrentAPISessionCertificateBadRequest creates CreateCurrentAPISessionCertificateBadRequest with default headers values
+func NewCreateCurrentAPISessionCertificateBadRequest() *CreateCurrentAPISessionCertificateBadRequest {
+
+	return &CreateCurrentAPISessionCertificateBadRequest{}
+}
+
+// WithPayload adds the payload to the create current Api session certificate bad request response
+func (o *CreateCurrentAPISessionCertificateBadRequest) WithPayload(payload *rest_model.APIErrorEnvelope) *CreateCurrentAPISessionCertificateBadRequest {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the create current Api session certificate bad request response
+func (o *CreateCurrentAPISessionCertificateBadRequest) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *CreateCurrentAPISessionCertificateBadRequest) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(400)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// CreateCurrentAPISessionCertificateUnauthorizedCode is the HTTP code returned for type CreateCurrentAPISessionCertificateUnauthorized
+const CreateCurrentAPISessionCertificateUnauthorizedCode int = 401
+
+/*CreateCurrentAPISessionCertificateUnauthorized The currently supplied session does not have the correct access rights to request this resource
+
+swagger:response createCurrentApiSessionCertificateUnauthorized
+*/
+type CreateCurrentAPISessionCertificateUnauthorized struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewCreateCurrentAPISessionCertificateUnauthorized creates CreateCurrentAPISessionCertificateUnauthorized with default headers values
+func NewCreateCurrentAPISessionCertificateUnauthorized() *CreateCurrentAPISessionCertificateUnauthorized {
+
+	return &CreateCurrentAPISessionCertificateUnauthorized{}
+}
+
+// WithPayload adds the payload to the create current Api session certificate unauthorized response
+func (o *CreateCurrentAPISessionCertificateUnauthorized) WithPayload(payload *rest_model.APIErrorEnvelope) *CreateCurrentAPISessionCertificateUnauthorized {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the create current Api session certificate unauthorized response
+func (o *CreateCurrentAPISessionCertificateUnauthorized) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *CreateCurrentAPISessionCertificateUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(401)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}

rest_server/operations/current_api_session/create_current_api_session_certificate_urlbuilder.go

@@ -0,0 +1,111 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+)
+
+// CreateCurrentAPISessionCertificateURL generates an URL for the create current Api session certificate operation
+type CreateCurrentAPISessionCertificateURL struct {
+	_basePath string
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *CreateCurrentAPISessionCertificateURL) WithBasePath(bp string) *CreateCurrentAPISessionCertificateURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *CreateCurrentAPISessionCertificateURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *CreateCurrentAPISessionCertificateURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/current-api-session/certificates"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *CreateCurrentAPISessionCertificateURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *CreateCurrentAPISessionCertificateURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *CreateCurrentAPISessionCertificateURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on CreateCurrentAPISessionCertificateURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on CreateCurrentAPISessionCertificateURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *CreateCurrentAPISessionCertificateURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server/operations/current_api_session/delete_current_api_session.go

@@ -53,7 +53,7 @@ func NewDeleteCurrentAPISession(ctx *middleware.Context, handler DeleteCurrentAP
 	return &DeleteCurrentAPISession{Context: ctx, Handler: handler}
 }
 
-/*DeleteCurrentAPISession swagger:route DELETE /current-api-session CurrentAPI Session deleteCurrentApiSession
+/*DeleteCurrentAPISession swagger:route DELETE /current-api-session Current API Session deleteCurrentApiSession
 
 Logout
 

rest_server/operations/current_api_session/delete_current_api_session_certificate.go

@@ -0,0 +1,98 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// DeleteCurrentAPISessionCertificateHandlerFunc turns a function with the right signature into a delete current Api session certificate handler
+type DeleteCurrentAPISessionCertificateHandlerFunc func(DeleteCurrentAPISessionCertificateParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn DeleteCurrentAPISessionCertificateHandlerFunc) Handle(params DeleteCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// DeleteCurrentAPISessionCertificateHandler interface for that can handle valid delete current Api session certificate params
+type DeleteCurrentAPISessionCertificateHandler interface {
+	Handle(DeleteCurrentAPISessionCertificateParams, interface{}) middleware.Responder
+}
+
+// NewDeleteCurrentAPISessionCertificate creates a new http.Handler for the delete current Api session certificate operation
+func NewDeleteCurrentAPISessionCertificate(ctx *middleware.Context, handler DeleteCurrentAPISessionCertificateHandler) *DeleteCurrentAPISessionCertificate {
+	return &DeleteCurrentAPISessionCertificate{Context: ctx, Handler: handler}
+}
+
+/*DeleteCurrentAPISessionCertificate swagger:route DELETE /current-api-session/certificates/{id} Current API Session deleteCurrentApiSessionCertificate
+
+Delete an ephemeral certificate
+
+Delete an ephemeral certificateby id
+
+
+*/
+type DeleteCurrentAPISessionCertificate struct {
+	Context *middleware.Context
+	Handler DeleteCurrentAPISessionCertificateHandler
+}
+
+func (o *DeleteCurrentAPISessionCertificate) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		r = rCtx
+	}
+	var Params = NewDeleteCurrentAPISessionCertificateParams()
+
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		r = aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}

rest_server/operations/current_api_session/delete_current_api_session_certificate_parameters.go

@@ -0,0 +1,96 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewDeleteCurrentAPISessionCertificateParams creates a new DeleteCurrentAPISessionCertificateParams object
+// no default values defined in spec.
+func NewDeleteCurrentAPISessionCertificateParams() DeleteCurrentAPISessionCertificateParams {
+
+	return DeleteCurrentAPISessionCertificateParams{}
+}
+
+// DeleteCurrentAPISessionCertificateParams contains all the bound params for the delete current Api session certificate operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters deleteCurrentApiSessionCertificate
+type DeleteCurrentAPISessionCertificateParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*The id of the requested resource
+	  Required: true
+	  In: path
+	*/
+	ID string
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewDeleteCurrentAPISessionCertificateParams() beforehand.
+func (o *DeleteCurrentAPISessionCertificateParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	rID, rhkID, _ := route.Params.GetOK("id")
+	if err := o.bindID(rID, rhkID, route.Formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindID binds and validates parameter ID from path.
+func (o *DeleteCurrentAPISessionCertificateParams) bindID(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+
+	o.ID = raw
+
+	return nil
+}

rest_server/operations/current_api_session/delete_current_api_session_certificate_responses.go

@@ -0,0 +1,170 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// DeleteCurrentAPISessionCertificateOKCode is the HTTP code returned for type DeleteCurrentAPISessionCertificateOK
+const DeleteCurrentAPISessionCertificateOKCode int = 200
+
+/*DeleteCurrentAPISessionCertificateOK The delete request was successful and the resource has been removed
+
+swagger:response deleteCurrentApiSessionCertificateOK
+*/
+type DeleteCurrentAPISessionCertificateOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.Empty `json:"body,omitempty"`
+}
+
+// NewDeleteCurrentAPISessionCertificateOK creates DeleteCurrentAPISessionCertificateOK with default headers values
+func NewDeleteCurrentAPISessionCertificateOK() *DeleteCurrentAPISessionCertificateOK {
+
+	return &DeleteCurrentAPISessionCertificateOK{}
+}
+
+// WithPayload adds the payload to the delete current Api session certificate o k response
+func (o *DeleteCurrentAPISessionCertificateOK) WithPayload(payload *rest_model.Empty) *DeleteCurrentAPISessionCertificateOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the delete current Api session certificate o k response
+func (o *DeleteCurrentAPISessionCertificateOK) SetPayload(payload *rest_model.Empty) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *DeleteCurrentAPISessionCertificateOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// DeleteCurrentAPISessionCertificateBadRequestCode is the HTTP code returned for type DeleteCurrentAPISessionCertificateBadRequest
+const DeleteCurrentAPISessionCertificateBadRequestCode int = 400
+
+/*DeleteCurrentAPISessionCertificateBadRequest The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
+
+swagger:response deleteCurrentApiSessionCertificateBadRequest
+*/
+type DeleteCurrentAPISessionCertificateBadRequest struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewDeleteCurrentAPISessionCertificateBadRequest creates DeleteCurrentAPISessionCertificateBadRequest with default headers values
+func NewDeleteCurrentAPISessionCertificateBadRequest() *DeleteCurrentAPISessionCertificateBadRequest {
+
+	return &DeleteCurrentAPISessionCertificateBadRequest{}
+}
+
+// WithPayload adds the payload to the delete current Api session certificate bad request response
+func (o *DeleteCurrentAPISessionCertificateBadRequest) WithPayload(payload *rest_model.APIErrorEnvelope) *DeleteCurrentAPISessionCertificateBadRequest {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the delete current Api session certificate bad request response
+func (o *DeleteCurrentAPISessionCertificateBadRequest) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *DeleteCurrentAPISessionCertificateBadRequest) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(400)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// DeleteCurrentAPISessionCertificateUnauthorizedCode is the HTTP code returned for type DeleteCurrentAPISessionCertificateUnauthorized
+const DeleteCurrentAPISessionCertificateUnauthorizedCode int = 401
+
+/*DeleteCurrentAPISessionCertificateUnauthorized The currently supplied session does not have the correct access rights to request this resource
+
+swagger:response deleteCurrentApiSessionCertificateUnauthorized
+*/
+type DeleteCurrentAPISessionCertificateUnauthorized struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewDeleteCurrentAPISessionCertificateUnauthorized creates DeleteCurrentAPISessionCertificateUnauthorized with default headers values
+func NewDeleteCurrentAPISessionCertificateUnauthorized() *DeleteCurrentAPISessionCertificateUnauthorized {
+
+	return &DeleteCurrentAPISessionCertificateUnauthorized{}
+}
+
+// WithPayload adds the payload to the delete current Api session certificate unauthorized response
+func (o *DeleteCurrentAPISessionCertificateUnauthorized) WithPayload(payload *rest_model.APIErrorEnvelope) *DeleteCurrentAPISessionCertificateUnauthorized {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the delete current Api session certificate unauthorized response
+func (o *DeleteCurrentAPISessionCertificateUnauthorized) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *DeleteCurrentAPISessionCertificateUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(401)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}

rest_server/operations/current_api_session/delete_current_api_session_certificate_urlbuilder.go

@@ -0,0 +1,123 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+	"strings"
+)
+
+// DeleteCurrentAPISessionCertificateURL generates an URL for the delete current Api session certificate operation
+type DeleteCurrentAPISessionCertificateURL struct {
+	ID string
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *DeleteCurrentAPISessionCertificateURL) WithBasePath(bp string) *DeleteCurrentAPISessionCertificateURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *DeleteCurrentAPISessionCertificateURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *DeleteCurrentAPISessionCertificateURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/current-api-session/certificates/{id}"
+
+	id := o.ID
+	if id != "" {
+		_path = strings.Replace(_path, "{id}", id, -1)
+	} else {
+		return nil, errors.New("id is required on DeleteCurrentAPISessionCertificateURL")
+	}
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *DeleteCurrentAPISessionCertificateURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *DeleteCurrentAPISessionCertificateURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *DeleteCurrentAPISessionCertificateURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on DeleteCurrentAPISessionCertificateURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on DeleteCurrentAPISessionCertificateURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *DeleteCurrentAPISessionCertificateURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server/operations/current_api_session/detail_current_api_session_certificate.go

@@ -0,0 +1,97 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// DetailCurrentAPISessionCertificateHandlerFunc turns a function with the right signature into a detail current Api session certificate handler
+type DetailCurrentAPISessionCertificateHandlerFunc func(DetailCurrentAPISessionCertificateParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn DetailCurrentAPISessionCertificateHandlerFunc) Handle(params DetailCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// DetailCurrentAPISessionCertificateHandler interface for that can handle valid detail current Api session certificate params
+type DetailCurrentAPISessionCertificateHandler interface {
+	Handle(DetailCurrentAPISessionCertificateParams, interface{}) middleware.Responder
+}
+
+// NewDetailCurrentAPISessionCertificate creates a new http.Handler for the detail current Api session certificate operation
+func NewDetailCurrentAPISessionCertificate(ctx *middleware.Context, handler DetailCurrentAPISessionCertificateHandler) *DetailCurrentAPISessionCertificate {
+	return &DetailCurrentAPISessionCertificate{Context: ctx, Handler: handler}
+}
+
+/*DetailCurrentAPISessionCertificate swagger:route GET /current-api-session/certificates/{id} Current API Session detailCurrentApiSessionCertificate
+
+Retrieves an ephemeral certificate
+
+Retrieves a single ephemeral certificate by id
+
+*/
+type DetailCurrentAPISessionCertificate struct {
+	Context *middleware.Context
+	Handler DetailCurrentAPISessionCertificateHandler
+}
+
+func (o *DetailCurrentAPISessionCertificate) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		r = rCtx
+	}
+	var Params = NewDetailCurrentAPISessionCertificateParams()
+
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		r = aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}

rest_server/operations/current_api_session/detail_current_api_session_certificate_parameters.go

@@ -0,0 +1,96 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+)
+
+// NewDetailCurrentAPISessionCertificateParams creates a new DetailCurrentAPISessionCertificateParams object
+// no default values defined in spec.
+func NewDetailCurrentAPISessionCertificateParams() DetailCurrentAPISessionCertificateParams {
+
+	return DetailCurrentAPISessionCertificateParams{}
+}
+
+// DetailCurrentAPISessionCertificateParams contains all the bound params for the detail current Api session certificate operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters detailCurrentApiSessionCertificate
+type DetailCurrentAPISessionCertificateParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*The id of the requested resource
+	  Required: true
+	  In: path
+	*/
+	ID string
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewDetailCurrentAPISessionCertificateParams() beforehand.
+func (o *DetailCurrentAPISessionCertificateParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	rID, rhkID, _ := route.Params.GetOK("id")
+	if err := o.bindID(rID, rhkID, route.Formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindID binds and validates parameter ID from path.
+func (o *DetailCurrentAPISessionCertificateParams) bindID(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: true
+	// Parameter is provided by construction from the route
+
+	o.ID = raw
+
+	return nil
+}

rest_server/operations/current_api_session/detail_current_api_session_certificate_responses.go

@@ -0,0 +1,170 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// DetailCurrentAPISessionCertificateOKCode is the HTTP code returned for type DetailCurrentAPISessionCertificateOK
+const DetailCurrentAPISessionCertificateOKCode int = 200
+
+/*DetailCurrentAPISessionCertificateOK A response containing a single API Session certificate
+
+swagger:response detailCurrentApiSessionCertificateOK
+*/
+type DetailCurrentAPISessionCertificateOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.DetailCurrentAPISessionCertificateEnvelope `json:"body,omitempty"`
+}
+
+// NewDetailCurrentAPISessionCertificateOK creates DetailCurrentAPISessionCertificateOK with default headers values
+func NewDetailCurrentAPISessionCertificateOK() *DetailCurrentAPISessionCertificateOK {
+
+	return &DetailCurrentAPISessionCertificateOK{}
+}
+
+// WithPayload adds the payload to the detail current Api session certificate o k response
+func (o *DetailCurrentAPISessionCertificateOK) WithPayload(payload *rest_model.DetailCurrentAPISessionCertificateEnvelope) *DetailCurrentAPISessionCertificateOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the detail current Api session certificate o k response
+func (o *DetailCurrentAPISessionCertificateOK) SetPayload(payload *rest_model.DetailCurrentAPISessionCertificateEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *DetailCurrentAPISessionCertificateOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// DetailCurrentAPISessionCertificateUnauthorizedCode is the HTTP code returned for type DetailCurrentAPISessionCertificateUnauthorized
+const DetailCurrentAPISessionCertificateUnauthorizedCode int = 401
+
+/*DetailCurrentAPISessionCertificateUnauthorized The currently supplied session does not have the correct access rights to request this resource
+
+swagger:response detailCurrentApiSessionCertificateUnauthorized
+*/
+type DetailCurrentAPISessionCertificateUnauthorized struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewDetailCurrentAPISessionCertificateUnauthorized creates DetailCurrentAPISessionCertificateUnauthorized with default headers values
+func NewDetailCurrentAPISessionCertificateUnauthorized() *DetailCurrentAPISessionCertificateUnauthorized {
+
+	return &DetailCurrentAPISessionCertificateUnauthorized{}
+}
+
+// WithPayload adds the payload to the detail current Api session certificate unauthorized response
+func (o *DetailCurrentAPISessionCertificateUnauthorized) WithPayload(payload *rest_model.APIErrorEnvelope) *DetailCurrentAPISessionCertificateUnauthorized {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the detail current Api session certificate unauthorized response
+func (o *DetailCurrentAPISessionCertificateUnauthorized) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *DetailCurrentAPISessionCertificateUnauthorized) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(401)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}
+
+// DetailCurrentAPISessionCertificateNotFoundCode is the HTTP code returned for type DetailCurrentAPISessionCertificateNotFound
+const DetailCurrentAPISessionCertificateNotFoundCode int = 404
+
+/*DetailCurrentAPISessionCertificateNotFound The requested resource does not exist
+
+swagger:response detailCurrentApiSessionCertificateNotFound
+*/
+type DetailCurrentAPISessionCertificateNotFound struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.APIErrorEnvelope `json:"body,omitempty"`
+}
+
+// NewDetailCurrentAPISessionCertificateNotFound creates DetailCurrentAPISessionCertificateNotFound with default headers values
+func NewDetailCurrentAPISessionCertificateNotFound() *DetailCurrentAPISessionCertificateNotFound {
+
+	return &DetailCurrentAPISessionCertificateNotFound{}
+}
+
+// WithPayload adds the payload to the detail current Api session certificate not found response
+func (o *DetailCurrentAPISessionCertificateNotFound) WithPayload(payload *rest_model.APIErrorEnvelope) *DetailCurrentAPISessionCertificateNotFound {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the detail current Api session certificate not found response
+func (o *DetailCurrentAPISessionCertificateNotFound) SetPayload(payload *rest_model.APIErrorEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *DetailCurrentAPISessionCertificateNotFound) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(404)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}

rest_server/operations/current_api_session/detail_current_api_session_certificate_urlbuilder.go

@@ -0,0 +1,123 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+	"strings"
+)
+
+// DetailCurrentAPISessionCertificateURL generates an URL for the detail current Api session certificate operation
+type DetailCurrentAPISessionCertificateURL struct {
+	ID string
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *DetailCurrentAPISessionCertificateURL) WithBasePath(bp string) *DetailCurrentAPISessionCertificateURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *DetailCurrentAPISessionCertificateURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *DetailCurrentAPISessionCertificateURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/current-api-session/certificates/{id}"
+
+	id := o.ID
+	if id != "" {
+		_path = strings.Replace(_path, "{id}", id, -1)
+	} else {
+		return nil, errors.New("id is required on DetailCurrentAPISessionCertificateURL")
+	}
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *DetailCurrentAPISessionCertificateURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *DetailCurrentAPISessionCertificateURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *DetailCurrentAPISessionCertificateURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on DetailCurrentAPISessionCertificateURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on DetailCurrentAPISessionCertificateURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *DetailCurrentAPISessionCertificateURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server/operations/current_api_session/list_current_api_session_certificates.go

@@ -0,0 +1,97 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime/middleware"
+)
+
+// ListCurrentAPISessionCertificatesHandlerFunc turns a function with the right signature into a list current Api session certificates handler
+type ListCurrentAPISessionCertificatesHandlerFunc func(ListCurrentAPISessionCertificatesParams, interface{}) middleware.Responder
+
+// Handle executing the request and returning a response
+func (fn ListCurrentAPISessionCertificatesHandlerFunc) Handle(params ListCurrentAPISessionCertificatesParams, principal interface{}) middleware.Responder {
+	return fn(params, principal)
+}
+
+// ListCurrentAPISessionCertificatesHandler interface for that can handle valid list current Api session certificates params
+type ListCurrentAPISessionCertificatesHandler interface {
+	Handle(ListCurrentAPISessionCertificatesParams, interface{}) middleware.Responder
+}
+
+// NewListCurrentAPISessionCertificates creates a new http.Handler for the list current Api session certificates operation
+func NewListCurrentAPISessionCertificates(ctx *middleware.Context, handler ListCurrentAPISessionCertificatesHandler) *ListCurrentAPISessionCertificates {
+	return &ListCurrentAPISessionCertificates{Context: ctx, Handler: handler}
+}
+
+/*ListCurrentAPISessionCertificates swagger:route GET /current-api-session/certificates Current API Session listCurrentApiSessionCertificates
+
+List the ephemeral certificates available for the current API Session
+
+Retrieves a list of certificate resources for the current API session; supports filtering, sorting, and pagination
+
+*/
+type ListCurrentAPISessionCertificates struct {
+	Context *middleware.Context
+	Handler ListCurrentAPISessionCertificatesHandler
+}
+
+func (o *ListCurrentAPISessionCertificates) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
+	route, rCtx, _ := o.Context.RouteInfo(r)
+	if rCtx != nil {
+		r = rCtx
+	}
+	var Params = NewListCurrentAPISessionCertificatesParams()
+
+	uprinc, aCtx, err := o.Context.Authorize(r, route)
+	if err != nil {
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+	if aCtx != nil {
+		r = aCtx
+	}
+	var principal interface{}
+	if uprinc != nil {
+		principal = uprinc
+	}
+
+	if err := o.Context.BindValidRequest(r, route, &Params); err != nil { // bind params
+		o.Context.Respond(rw, r, route.Produces, route, err)
+		return
+	}
+
+	res := o.Handler.Handle(Params, principal) // actually handle the request
+
+	o.Context.Respond(rw, r, route.Produces, route, res)
+
+}

rest_server/operations/current_api_session/list_current_api_session_certificates_parameters.go

@@ -0,0 +1,164 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/errors"
+	"github.com/go-openapi/runtime"
+	"github.com/go-openapi/runtime/middleware"
+	"github.com/go-openapi/strfmt"
+	"github.com/go-openapi/swag"
+)
+
+// NewListCurrentAPISessionCertificatesParams creates a new ListCurrentAPISessionCertificatesParams object
+// no default values defined in spec.
+func NewListCurrentAPISessionCertificatesParams() ListCurrentAPISessionCertificatesParams {
+
+	return ListCurrentAPISessionCertificatesParams{}
+}
+
+// ListCurrentAPISessionCertificatesParams contains all the bound params for the list current Api session certificates operation
+// typically these are obtained from a http.Request
+//
+// swagger:parameters listCurrentApiSessionCertificates
+type ListCurrentAPISessionCertificatesParams struct {
+
+	// HTTP Request Object
+	HTTPRequest *http.Request `json:"-"`
+
+	/*
+	  In: query
+	*/
+	Filter *string
+	/*
+	  In: query
+	*/
+	Limit *int64
+	/*
+	  In: query
+	*/
+	Offset *int64
+}
+
+// BindRequest both binds and validates a request, it assumes that complex things implement a Validatable(strfmt.Registry) error interface
+// for simple values it will use straight method calls.
+//
+// To ensure default values, the struct must have been initialized with NewListCurrentAPISessionCertificatesParams() beforehand.
+func (o *ListCurrentAPISessionCertificatesParams) BindRequest(r *http.Request, route *middleware.MatchedRoute) error {
+	var res []error
+
+	o.HTTPRequest = r
+
+	qs := runtime.Values(r.URL.Query())
+
+	qFilter, qhkFilter, _ := qs.GetOK("filter")
+	if err := o.bindFilter(qFilter, qhkFilter, route.Formats); err != nil {
+		res = append(res, err)
+	}
+
+	qLimit, qhkLimit, _ := qs.GetOK("limit")
+	if err := o.bindLimit(qLimit, qhkLimit, route.Formats); err != nil {
+		res = append(res, err)
+	}
+
+	qOffset, qhkOffset, _ := qs.GetOK("offset")
+	if err := o.bindOffset(qOffset, qhkOffset, route.Formats); err != nil {
+		res = append(res, err)
+	}
+
+	if len(res) > 0 {
+		return errors.CompositeValidationError(res...)
+	}
+	return nil
+}
+
+// bindFilter binds and validates parameter Filter from query.
+func (o *ListCurrentAPISessionCertificatesParams) bindFilter(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: false
+	// AllowEmptyValue: false
+	if raw == "" { // empty values pass all other validations
+		return nil
+	}
+
+	o.Filter = &raw
+
+	return nil
+}
+
+// bindLimit binds and validates parameter Limit from query.
+func (o *ListCurrentAPISessionCertificatesParams) bindLimit(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: false
+	// AllowEmptyValue: false
+	if raw == "" { // empty values pass all other validations
+		return nil
+	}
+
+	value, err := swag.ConvertInt64(raw)
+	if err != nil {
+		return errors.InvalidType("limit", "query", "int64", raw)
+	}
+	o.Limit = &value
+
+	return nil
+}
+
+// bindOffset binds and validates parameter Offset from query.
+func (o *ListCurrentAPISessionCertificatesParams) bindOffset(rawData []string, hasKey bool, formats strfmt.Registry) error {
+	var raw string
+	if len(rawData) > 0 {
+		raw = rawData[len(rawData)-1]
+	}
+
+	// Required: false
+	// AllowEmptyValue: false
+	if raw == "" { // empty values pass all other validations
+		return nil
+	}
+
+	value, err := swag.ConvertInt64(raw)
+	if err != nil {
+		return errors.InvalidType("offset", "query", "int64", raw)
+	}
+	o.Offset = &value
+
+	return nil
+}

rest_server/operations/current_api_session/list_current_api_session_certificates_responses.go

@@ -0,0 +1,82 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the swagger generate command
+
+import (
+	"net/http"
+
+	"github.com/go-openapi/runtime"
+
+	"github.com/openziti/edge/rest_model"
+)
+
+// ListCurrentAPISessionCertificatesOKCode is the HTTP code returned for type ListCurrentAPISessionCertificatesOK
+const ListCurrentAPISessionCertificatesOKCode int = 200
+
+/*ListCurrentAPISessionCertificatesOK A list of the current API Session's certificate
+
+swagger:response listCurrentApiSessionCertificatesOK
+*/
+type ListCurrentAPISessionCertificatesOK struct {
+
+	/*
+	  In: Body
+	*/
+	Payload *rest_model.ListCurrentAPISessionCertificatesEnvelope `json:"body,omitempty"`
+}
+
+// NewListCurrentAPISessionCertificatesOK creates ListCurrentAPISessionCertificatesOK with default headers values
+func NewListCurrentAPISessionCertificatesOK() *ListCurrentAPISessionCertificatesOK {
+
+	return &ListCurrentAPISessionCertificatesOK{}
+}
+
+// WithPayload adds the payload to the list current Api session certificates o k response
+func (o *ListCurrentAPISessionCertificatesOK) WithPayload(payload *rest_model.ListCurrentAPISessionCertificatesEnvelope) *ListCurrentAPISessionCertificatesOK {
+	o.Payload = payload
+	return o
+}
+
+// SetPayload sets the payload to the list current Api session certificates o k response
+func (o *ListCurrentAPISessionCertificatesOK) SetPayload(payload *rest_model.ListCurrentAPISessionCertificatesEnvelope) {
+	o.Payload = payload
+}
+
+// WriteResponse to the client
+func (o *ListCurrentAPISessionCertificatesOK) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) {
+
+	rw.WriteHeader(200)
+	if o.Payload != nil {
+		payload := o.Payload
+		if err := producer.Produce(rw, payload); err != nil {
+			panic(err) // let the recovery middleware deal with this
+		}
+	}
+}

rest_server/operations/current_api_session/list_current_api_session_certificates_urlbuilder.go

@@ -0,0 +1,147 @@
+// Code generated by go-swagger; DO NOT EDIT.
+
+//
+// Copyright NetFoundry, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// __          __              _
+// \ \        / /             (_)
+//  \ \  /\  / /_ _ _ __ _ __  _ _ __   __ _
+//   \ \/  \/ / _` | '__| '_ \| | '_ \ / _` |
+//    \  /\  / (_| | |  | | | | | | | | (_| | : This file is generated, do not edit it.
+//     \/  \/ \__,_|_|  |_| |_|_|_| |_|\__, |
+//                                      __/ |
+//                                     |___/
+
+package current_api_session
+
+// This file was generated by the swagger tool.
+// Editing this file might prove futile when you re-run the generate command
+
+import (
+	"errors"
+	"net/url"
+	golangswaggerpaths "path"
+
+	"github.com/go-openapi/swag"
+)
+
+// ListCurrentAPISessionCertificatesURL generates an URL for the list current Api session certificates operation
+type ListCurrentAPISessionCertificatesURL struct {
+	Filter *string
+	Limit  *int64
+	Offset *int64
+
+	_basePath string
+	// avoid unkeyed usage
+	_ struct{}
+}
+
+// WithBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListCurrentAPISessionCertificatesURL) WithBasePath(bp string) *ListCurrentAPISessionCertificatesURL {
+	o.SetBasePath(bp)
+	return o
+}
+
+// SetBasePath sets the base path for this url builder, only required when it's different from the
+// base path specified in the swagger spec.
+// When the value of the base path is an empty string
+func (o *ListCurrentAPISessionCertificatesURL) SetBasePath(bp string) {
+	o._basePath = bp
+}
+
+// Build a url path and query string
+func (o *ListCurrentAPISessionCertificatesURL) Build() (*url.URL, error) {
+	var _result url.URL
+
+	var _path = "/current-api-session/certificates"
+
+	_basePath := o._basePath
+	if _basePath == "" {
+		_basePath = "/edge/v1"
+	}
+	_result.Path = golangswaggerpaths.Join(_basePath, _path)
+
+	qs := make(url.Values)
+
+	var filterQ string
+	if o.Filter != nil {
+		filterQ = *o.Filter
+	}
+	if filterQ != "" {
+		qs.Set("filter", filterQ)
+	}
+
+	var limitQ string
+	if o.Limit != nil {
+		limitQ = swag.FormatInt64(*o.Limit)
+	}
+	if limitQ != "" {
+		qs.Set("limit", limitQ)
+	}
+
+	var offsetQ string
+	if o.Offset != nil {
+		offsetQ = swag.FormatInt64(*o.Offset)
+	}
+	if offsetQ != "" {
+		qs.Set("offset", offsetQ)
+	}
+
+	_result.RawQuery = qs.Encode()
+
+	return &_result, nil
+}
+
+// Must is a helper function to panic when the url builder returns an error
+func (o *ListCurrentAPISessionCertificatesURL) Must(u *url.URL, err error) *url.URL {
+	if err != nil {
+		panic(err)
+	}
+	if u == nil {
+		panic("url can't be nil")
+	}
+	return u
+}
+
+// String returns the string representation of the path with query string
+func (o *ListCurrentAPISessionCertificatesURL) String() string {
+	return o.Must(o.Build()).String()
+}
+
+// BuildFull builds a full url with scheme, host, path and query string
+func (o *ListCurrentAPISessionCertificatesURL) BuildFull(scheme, host string) (*url.URL, error) {
+	if scheme == "" {
+		return nil, errors.New("scheme is required for a full url on ListCurrentAPISessionCertificatesURL")
+	}
+	if host == "" {
+		return nil, errors.New("host is required for a full url on ListCurrentAPISessionCertificatesURL")
+	}
+
+	base, err := o.Build()
+	if err != nil {
+		return nil, err
+	}
+
+	base.Scheme = scheme
+	base.Host = host
+	return base, nil
+}
+
+// StringFull returns the string representation of a complete url
+func (o *ListCurrentAPISessionCertificatesURL) StringFull(scheme, host string) string {
+	return o.Must(o.BuildFull(scheme, host)).String()
+}

rest_server/operations/ziti_edge_api.go

@@ -137,6 +137,9 @@ func NewZitiEdgeAPI(spec *loads.Document) *ZitiEdgeAPI {
 		ConfigCreateConfigTypeHandler: config.CreateConfigTypeHandlerFunc(func(params config.CreateConfigTypeParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation config.CreateConfigType has not yet been implemented")
 		}),
+		CurrentAPISessionCreateCurrentAPISessionCertificateHandler: current_api_session.CreateCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.CreateCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.CreateCurrentAPISessionCertificate has not yet been implemented")
+		}),
 		DatabaseCreateDatabaseSnapshotHandler: database.CreateDatabaseSnapshotHandlerFunc(func(params database.CreateDatabaseSnapshotParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation database.CreateDatabaseSnapshot has not yet been implemented")
 		}),
@@ -188,6 +191,9 @@ func NewZitiEdgeAPI(spec *loads.Document) *ZitiEdgeAPI {
 		ConfigDeleteConfigTypeHandler: config.DeleteConfigTypeHandlerFunc(func(params config.DeleteConfigTypeParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation config.DeleteConfigType has not yet been implemented")
 		}),
+		CurrentAPISessionDeleteCurrentAPISessionCertificateHandler: current_api_session.DeleteCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.DeleteCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.DeleteCurrentAPISessionCertificate has not yet been implemented")
+		}),
 		EdgeRouterDeleteEdgeRouterHandler: edge_router.DeleteEdgeRouterHandlerFunc(func(params edge_router.DeleteEdgeRouterParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation edge_router.DeleteEdgeRouter has not yet been implemented")
 		}),
@@ -236,6 +242,9 @@ func NewZitiEdgeAPI(spec *loads.Document) *ZitiEdgeAPI {
 		ConfigDetailConfigTypeHandler: config.DetailConfigTypeHandlerFunc(func(params config.DetailConfigTypeParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation config.DetailConfigType has not yet been implemented")
 		}),
+		CurrentAPISessionDetailCurrentAPISessionCertificateHandler: current_api_session.DetailCurrentAPISessionCertificateHandlerFunc(func(params current_api_session.DetailCurrentAPISessionCertificateParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.DetailCurrentAPISessionCertificate has not yet been implemented")
+		}),
 		CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler: current_api_session.DetailCurrentIdentityAuthenticatorHandlerFunc(func(params current_api_session.DetailCurrentIdentityAuthenticatorParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation current_api_session.DetailCurrentIdentityAuthenticator has not yet been implemented")
 		}),
@@ -344,6 +353,9 @@ func NewZitiEdgeAPI(spec *loads.Document) *ZitiEdgeAPI {
 		ConfigListConfigsForConfigTypeHandler: config.ListConfigsForConfigTypeHandlerFunc(func(params config.ListConfigsForConfigTypeParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation config.ListConfigsForConfigType has not yet been implemented")
 		}),
+		CurrentAPISessionListCurrentAPISessionCertificatesHandler: current_api_session.ListCurrentAPISessionCertificatesHandlerFunc(func(params current_api_session.ListCurrentAPISessionCertificatesParams, principal interface{}) middleware.Responder {
+			return middleware.NotImplemented("operation current_api_session.ListCurrentAPISessionCertificates has not yet been implemented")
+		}),
 		CurrentAPISessionListCurrentIdentityAuthenticatorsHandler: current_api_session.ListCurrentIdentityAuthenticatorsHandlerFunc(func(params current_api_session.ListCurrentIdentityAuthenticatorsParams, principal interface{}) middleware.Responder {
 			return middleware.NotImplemented("operation current_api_session.ListCurrentIdentityAuthenticators has not yet been implemented")
 		}),
@@ -657,6 +669,8 @@ type ZitiEdgeAPI struct {
 	ConfigCreateConfigHandler config.CreateConfigHandler
 	// ConfigCreateConfigTypeHandler sets the operation handler for the create config type operation
 	ConfigCreateConfigTypeHandler config.CreateConfigTypeHandler
+	// CurrentAPISessionCreateCurrentAPISessionCertificateHandler sets the operation handler for the create current Api session certificate operation
+	CurrentAPISessionCreateCurrentAPISessionCertificateHandler current_api_session.CreateCurrentAPISessionCertificateHandler
 	// DatabaseCreateDatabaseSnapshotHandler sets the operation handler for the create database snapshot operation
 	DatabaseCreateDatabaseSnapshotHandler database.CreateDatabaseSnapshotHandler
 	// EdgeRouterCreateEdgeRouterHandler sets the operation handler for the create edge router operation
@@ -691,6 +705,8 @@ type ZitiEdgeAPI struct {
 	ConfigDeleteConfigHandler config.DeleteConfigHandler
 	// ConfigDeleteConfigTypeHandler sets the operation handler for the delete config type operation
 	ConfigDeleteConfigTypeHandler config.DeleteConfigTypeHandler
+	// CurrentAPISessionDeleteCurrentAPISessionCertificateHandler sets the operation handler for the delete current Api session certificate operation
+	CurrentAPISessionDeleteCurrentAPISessionCertificateHandler current_api_session.DeleteCurrentAPISessionCertificateHandler
 	// EdgeRouterDeleteEdgeRouterHandler sets the operation handler for the delete edge router operation
 	EdgeRouterDeleteEdgeRouterHandler edge_router.DeleteEdgeRouterHandler
 	// EdgeRouterPolicyDeleteEdgeRouterPolicyHandler sets the operation handler for the delete edge router policy operation
@@ -723,6 +739,8 @@ type ZitiEdgeAPI struct {
 	ConfigDetailConfigHandler config.DetailConfigHandler
 	// ConfigDetailConfigTypeHandler sets the operation handler for the detail config type operation
 	ConfigDetailConfigTypeHandler config.DetailConfigTypeHandler
+	// CurrentAPISessionDetailCurrentAPISessionCertificateHandler sets the operation handler for the detail current Api session certificate operation
+	CurrentAPISessionDetailCurrentAPISessionCertificateHandler current_api_session.DetailCurrentAPISessionCertificateHandler
 	// CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler sets the operation handler for the detail current identity authenticator operation
 	CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler current_api_session.DetailCurrentIdentityAuthenticatorHandler
 	// EdgeRouterDetailEdgeRouterHandler sets the operation handler for the detail edge router operation
@@ -795,6 +813,8 @@ type ZitiEdgeAPI struct {
 	ConfigListConfigsHandler config.ListConfigsHandler
 	// ConfigListConfigsForConfigTypeHandler sets the operation handler for the list configs for config type operation
 	ConfigListConfigsForConfigTypeHandler config.ListConfigsForConfigTypeHandler
+	// CurrentAPISessionListCurrentAPISessionCertificatesHandler sets the operation handler for the list current Api session certificates operation
+	CurrentAPISessionListCurrentAPISessionCertificatesHandler current_api_session.ListCurrentAPISessionCertificatesHandler
 	// CurrentAPISessionListCurrentIdentityAuthenticatorsHandler sets the operation handler for the list current identity authenticators operation
 	CurrentAPISessionListCurrentIdentityAuthenticatorsHandler current_api_session.ListCurrentIdentityAuthenticatorsHandler
 	// EdgeRouterListEdgeRouterEdgeRouterPoliciesHandler sets the operation handler for the list edge router edge router policies operation
@@ -1073,6 +1093,9 @@ func (o *ZitiEdgeAPI) Validate() error {
 	if o.ConfigCreateConfigTypeHandler == nil {
 		unregistered = append(unregistered, "config.CreateConfigTypeHandler")
 	}
+	if o.CurrentAPISessionCreateCurrentAPISessionCertificateHandler == nil {
+		unregistered = append(unregistered, "current_api_session.CreateCurrentAPISessionCertificateHandler")
+	}
 	if o.DatabaseCreateDatabaseSnapshotHandler == nil {
 		unregistered = append(unregistered, "database.CreateDatabaseSnapshotHandler")
 	}
@@ -1124,6 +1147,9 @@ func (o *ZitiEdgeAPI) Validate() error {
 	if o.ConfigDeleteConfigTypeHandler == nil {
 		unregistered = append(unregistered, "config.DeleteConfigTypeHandler")
 	}
+	if o.CurrentAPISessionDeleteCurrentAPISessionCertificateHandler == nil {
+		unregistered = append(unregistered, "current_api_session.DeleteCurrentAPISessionCertificateHandler")
+	}
 	if o.EdgeRouterDeleteEdgeRouterHandler == nil {
 		unregistered = append(unregistered, "edge_router.DeleteEdgeRouterHandler")
 	}
@@ -1172,6 +1198,9 @@ func (o *ZitiEdgeAPI) Validate() error {
 	if o.ConfigDetailConfigTypeHandler == nil {
 		unregistered = append(unregistered, "config.DetailConfigTypeHandler")
 	}
+	if o.CurrentAPISessionDetailCurrentAPISessionCertificateHandler == nil {
+		unregistered = append(unregistered, "current_api_session.DetailCurrentAPISessionCertificateHandler")
+	}
 	if o.CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler == nil {
 		unregistered = append(unregistered, "current_api_session.DetailCurrentIdentityAuthenticatorHandler")
 	}
@@ -1280,6 +1309,9 @@ func (o *ZitiEdgeAPI) Validate() error {
 	if o.ConfigListConfigsForConfigTypeHandler == nil {
 		unregistered = append(unregistered, "config.ListConfigsForConfigTypeHandler")
 	}
+	if o.CurrentAPISessionListCurrentAPISessionCertificatesHandler == nil {
+		unregistered = append(unregistered, "current_api_session.ListCurrentAPISessionCertificatesHandler")
+	}
 	if o.CurrentAPISessionListCurrentIdentityAuthenticatorsHandler == nil {
 		unregistered = append(unregistered, "current_api_session.ListCurrentIdentityAuthenticatorsHandler")
 	}
@@ -1653,6 +1685,10 @@ func (o *ZitiEdgeAPI) initHandlerCache() {
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
 	}
+	o.handlers["POST"]["/current-api-session/certificates"] = current_api_session.NewCreateCurrentAPISessionCertificate(o.context, o.CurrentAPISessionCreateCurrentAPISessionCertificateHandler)
+	if o.handlers["POST"] == nil {
+		o.handlers["POST"] = make(map[string]http.Handler)
+	}
 	o.handlers["POST"]["/database/snapshot"] = database.NewCreateDatabaseSnapshot(o.context, o.DatabaseCreateDatabaseSnapshotHandler)
 	if o.handlers["POST"] == nil {
 		o.handlers["POST"] = make(map[string]http.Handler)
@@ -1721,6 +1757,10 @@ func (o *ZitiEdgeAPI) initHandlerCache() {
 	if o.handlers["DELETE"] == nil {
 		o.handlers["DELETE"] = make(map[string]http.Handler)
 	}
+	o.handlers["DELETE"]["/current-api-session/certificates/{id}"] = current_api_session.NewDeleteCurrentAPISessionCertificate(o.context, o.CurrentAPISessionDeleteCurrentAPISessionCertificateHandler)
+	if o.handlers["DELETE"] == nil {
+		o.handlers["DELETE"] = make(map[string]http.Handler)
+	}
 	o.handlers["DELETE"]["/edge-routers/{id}"] = edge_router.NewDeleteEdgeRouter(o.context, o.EdgeRouterDeleteEdgeRouterHandler)
 	if o.handlers["DELETE"] == nil {
 		o.handlers["DELETE"] = make(map[string]http.Handler)
@@ -1785,6 +1825,10 @@ func (o *ZitiEdgeAPI) initHandlerCache() {
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
+	o.handlers["GET"]["/current-api-session/certificates/{id}"] = current_api_session.NewDetailCurrentAPISessionCertificate(o.context, o.CurrentAPISessionDetailCurrentAPISessionCertificateHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
 	o.handlers["GET"]["/current-identity/authenticators/{id}"] = current_api_session.NewDetailCurrentIdentityAuthenticator(o.context, o.CurrentAPISessionDetailCurrentIdentityAuthenticatorHandler)
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
@@ -1929,6 +1973,10 @@ func (o *ZitiEdgeAPI) initHandlerCache() {
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)
 	}
+	o.handlers["GET"]["/current-api-session/certificates"] = current_api_session.NewListCurrentAPISessionCertificates(o.context, o.CurrentAPISessionListCurrentAPISessionCertificatesHandler)
+	if o.handlers["GET"] == nil {
+		o.handlers["GET"] = make(map[string]http.Handler)
+	}
 	o.handlers["GET"]["/current-identity/authenticators"] = current_api_session.NewListCurrentIdentityAuthenticators(o.context, o.CurrentAPISessionListCurrentIdentityAuthenticatorsHandler)
 	if o.handlers["GET"] == nil {
 		o.handlers["GET"] = make(map[string]http.Handler)

router/internal/fabric/manager.go

@@ -42,34 +42,40 @@ type RemoveListener func()
 type DisconnectCB func(token string)
 
 type StateManager interface {
+	//"Network" Sessions
+	GetSession(token string) *edge_ctrl_pb.Session
+	GetSessionWithTimeout(token string, timeout time.Duration) *edge_ctrl_pb.Session
 	AddSession(ns *edge_ctrl_pb.Session)
 	UpdateSession(ns *edge_ctrl_pb.Session)
 	RemoveSession(token string)
 	RemoveMissingSessions(knownSessions []*edge_ctrl_pb.Session)
+	AddSessionRemovedListener(token string, callBack func(token string)) RemoveListener
+
+	//ApiSessions
+	GetApiSession(token string) *edge_ctrl_pb.ApiSession
+	GetApiSessionByFingerprint(fingerprint string) chan *edge_ctrl_pb.ApiSession
 	AddApiSession(ns *edge_ctrl_pb.ApiSession)
 	UpdateApiSession(ns *edge_ctrl_pb.ApiSession)
 	RemoveApiSession(token string)
 	RemoveMissingApiSessions(knownSessions []*edge_ctrl_pb.ApiSession)
-	GetNetworkSession(token string) *edge_ctrl_pb.Session
-	GetNetworkSessionWithTimeout(token string, timeout time.Duration) *edge_ctrl_pb.Session
-	GetSessionByFingerprint(fingerprint string) chan *edge_ctrl_pb.ApiSession
-	GetSession(token string) *edge_ctrl_pb.ApiSession
-	AddNetworkSessionRemovedListener(token string, callBack func(token string)) RemoveListener
-	AddSessionRemovedListener(token string, callBack func(token string)) RemoveListener
+	AddConnectedApiSession(token string, removeCB func(), ch channel2.Channel)
+	RemoveConnectedApiSession(token string, underlay channel2.Channel)
+	AddApiSessionRemovedListener(token string, callBack func(token string)) RemoveListener
+
 	StartHeartbeat(channel channel2.Channel, seconds int)
-	AddConnectedSession(token string, removeCB func(), ch channel2.Channel)
-	RemoveConnectedSession(token string, underlay channel2.Channel)
 }
 
 type StateManagerImpl struct {
-	networkSessionsByToken *sync.Map
-	sessionsByToken        *sync.Map
-	supportedFabrics       *sync.Map
-	activeSessions         *sync.Map
-	Hostname               string
-	ControllerAddr         string
-	ClusterId              string
-	NodeId                 string
+	sessionsByToken    *sync.Map //"network" sessions
+	apiSessionsByToken *sync.Map
+
+	supportedFabrics  *sync.Map
+	activeApiSessions *sync.Map
+
+	Hostname       string
+	ControllerAddr string
+	ClusterId      string
+	NodeId         string
 	events.EventEmmiter
 	heartbeatRunner    runner.Runner
 	heartbeatOperation *heartbeatOperation
@@ -83,11 +89,11 @@ func GetStateManager() StateManager {
 	}
 
 	singleStateManager = &StateManagerImpl{
-		EventEmmiter:           events.New(),
-		networkSessionsByToken: &sync.Map{},
-		sessionsByToken:        &sync.Map{},
-		supportedFabrics:       &sync.Map{},
-		activeSessions:         &sync.Map{},
+		EventEmmiter:       events.New(),
+		sessionsByToken:    &sync.Map{},
+		apiSessionsByToken: &sync.Map{},
+		supportedFabrics:   &sync.Map{},
+		activeApiSessions:  &sync.Map{},
 	}
 
 	return singleStateManager
@@ -95,20 +101,32 @@ func GetStateManager() StateManager {
 
 func (sm *StateManagerImpl) AddApiSession(session *edge_ctrl_pb.ApiSession) {
 	pfxlog.Logger().Debugf("adding session [%s] fingerprints [%s]", session.Token, session.CertFingerprints)
-	sm.sessionsByToken.Store(session.Token, session)
+	sm.apiSessionsByToken.Store(session.Token, session)
 	sm.Emit(EventAddedSession, session)
 }
 
 func (sm *StateManagerImpl) UpdateApiSession(session *edge_ctrl_pb.ApiSession) {
 	pfxlog.Logger().Debugf("updating session [%s] fingerprints [%s]", session.Token, session.CertFingerprints)
-	sm.sessionsByToken.Store(session.Token, session)
+	sm.apiSessionsByToken.Store(session.Token, session)
+
+	sm.sessionsByToken.Range(func(key, value interface{}) bool {
+		if ns, ok := value.(*edge_ctrl_pb.Session); ok {
+			if ns.ApiSessionId == session.Id { //only update the specific api session's sessions
+				ns.CertFingerprints = session.CertFingerprints //session.CertFingerprints is all currently valid
+			}
+		} else {
+			pfxlog.Logger().Warn("could not convert value from concurrent map sessionsByToken to Session, this should not happen")
+		}
+		return true
+	})
+
 	sm.Emit(EventUpdatedSession, session)
 }
 
 func (sm *StateManagerImpl) RemoveApiSession(token string) {
-	if ns, ok := sm.sessionsByToken.Load(token); ok {
+	if ns, ok := sm.apiSessionsByToken.Load(token); ok {
 		pfxlog.Logger().Debugf("removing session [%s]", token)
-		sm.sessionsByToken.Delete(token)
+		sm.apiSessionsByToken.Delete(token)
 		eventName := sm.getSessionRemovedEventName(token)
 		sm.Emit(eventName)
 		sm.RemoveAllListeners(eventName)
@@ -124,7 +142,7 @@ func (sm *StateManagerImpl) RemoveMissingApiSessions(knownSessions []*edge_ctrl_
 	}
 
 	var tokensToRemove []string
-	sm.sessionsByToken.Range(func(key, _ interface{}) bool {
+	sm.apiSessionsByToken.Range(func(key, _ interface{}) bool {
 		token, _ := key.(string)
 		if _, ok := validTokens[token]; !ok {
 			tokensToRemove = append(tokensToRemove, token)
@@ -145,7 +163,7 @@ func (sm *StateManagerImpl) AddSession(ns *edge_ctrl_pb.Session) {
 	}
 
 	pfxlog.Logger().Debugf("adding network session [%s] fingerprints [%s] TypeId [%v]", ns.Token, ns.CertFingerprints, ns.Type.String())
-	sm.networkSessionsByToken.Store(ns.Token, ns)
+	sm.sessionsByToken.Store(ns.Token, ns)
 	sm.Emit(EventAddedNetworkSession, ns)
 }
 
@@ -157,7 +175,7 @@ func (sm *StateManagerImpl) UpdateSession(ns *edge_ctrl_pb.Session) {
 	}
 
 	pfxlog.Logger().Debugf("updating network session [%s] fingerprints [%s]", ns.Token, ns.CertFingerprints)
-	sm.networkSessionsByToken.Store(ns.Token, ns)
+	sm.sessionsByToken.Store(ns.Token, ns)
 	sm.Emit(EventUpdatedNetworkSession, ns)
 }
 
@@ -168,7 +186,7 @@ func (sm *StateManagerImpl) RemoveMissingSessions(knownSessions []*edge_ctrl_pb.
 	}
 
 	var tokensToRemove []string
-	sm.networkSessionsByToken.Range(func(key, _ interface{}) bool {
+	sm.sessionsByToken.Range(func(key, _ interface{}) bool {
 		token, _ := key.(string)
 		if _, ok := validTokens[token]; !ok {
 			tokensToRemove = append(tokensToRemove, token)
@@ -182,9 +200,9 @@ func (sm *StateManagerImpl) RemoveMissingSessions(knownSessions []*edge_ctrl_pb.
 }
 
 func (sm *StateManagerImpl) RemoveSession(token string) {
-	if ns, ok := sm.networkSessionsByToken.Load(token); ok {
+	if ns, ok := sm.sessionsByToken.Load(token); ok {
 		pfxlog.Logger().Debugf("removing network session [%s]", token)
-		sm.networkSessionsByToken.Delete(token)
+		sm.sessionsByToken.Delete(token)
 		sm.Emit(EventRemovedNetworkSession, ns)
 		eventName := sm.getNetworkSessionRemovedEventName(token)
 		sm.Emit(eventName)
@@ -194,8 +212,8 @@ func (sm *StateManagerImpl) RemoveSession(token string) {
 	}
 }
 
-func (sm *StateManagerImpl) GetSession(token string) *edge_ctrl_pb.ApiSession {
-	if val, ok := sm.sessionsByToken.Load(token); ok {
+func (sm *StateManagerImpl) GetApiSession(token string) *edge_ctrl_pb.ApiSession {
+	if val, ok := sm.apiSessionsByToken.Load(token); ok {
 		if session, ok := val.(*edge_ctrl_pb.ApiSession); ok {
 			return session
 		}
@@ -203,11 +221,11 @@ func (sm *StateManagerImpl) GetSession(token string) *edge_ctrl_pb.ApiSession {
 	return nil
 }
 
-func (sm *StateManagerImpl) GetSessionByFingerprint(fingerprint string) chan *edge_ctrl_pb.ApiSession {
+func (sm *StateManagerImpl) GetApiSessionByFingerprint(fingerprint string) chan *edge_ctrl_pb.ApiSession {
 	ch := make(chan *edge_ctrl_pb.ApiSession)
 	go func() {
 		found := false
-		sm.sessionsByToken.Range(func(_, value interface{}) bool {
+		sm.apiSessionsByToken.Range(func(_, value interface{}) bool {
 			if session, ok := value.(*edge_ctrl_pb.ApiSession); ok {
 				for _, curPrint := range session.CertFingerprints {
 					if fingerprint == curPrint {
@@ -228,8 +246,8 @@ func (sm *StateManagerImpl) GetSessionByFingerprint(fingerprint string) chan *ed
 	return ch
 }
 
-func (sm *StateManagerImpl) GetNetworkSession(token string) *edge_ctrl_pb.Session {
-	if obj, ok := sm.networkSessionsByToken.Load(token); ok {
+func (sm *StateManagerImpl) GetSession(token string) *edge_ctrl_pb.Session {
+	if obj, ok := sm.sessionsByToken.Load(token); ok {
 		if ns, ok := obj.(*edge_ctrl_pb.Session); ok {
 			return ns
 		}
@@ -239,15 +257,15 @@ func (sm *StateManagerImpl) GetNetworkSession(token string) *edge_ctrl_pb.Sessio
 	return nil
 }
 
-func (sm *StateManagerImpl) GetNetworkSessionWithTimeout(token string, timeout time.Duration) *edge_ctrl_pb.Session {
+func (sm *StateManagerImpl) GetSessionWithTimeout(token string, timeout time.Duration) *edge_ctrl_pb.Session {
 	deadline := time.Now().Add(timeout)
-	session := sm.GetNetworkSession(token)
+	session := sm.GetSession(token)
 
 	if session == nil {
 		//convert this to return a channel instead of sleeping
 		waitTime := time.Millisecond
 		for time.Now().Before(deadline) {
-			session = sm.GetNetworkSession(token)
+			session = sm.GetSession(token)
 			if session != nil {
 				return session
 			}
@@ -260,7 +278,7 @@ func (sm *StateManagerImpl) GetNetworkSessionWithTimeout(token string, timeout t
 	return session
 }
 
-func (sm *StateManagerImpl) AddNetworkSessionRemovedListener(token string, callBack func(token string)) RemoveListener {
+func (sm *StateManagerImpl) AddSessionRemovedListener(token string, callBack func(token string)) RemoveListener {
 	eventName := sm.getNetworkSessionRemovedEventName(token)
 	listener := func(args ...interface{}) {
 		callBack(token)
@@ -272,7 +290,7 @@ func (sm *StateManagerImpl) AddNetworkSessionRemovedListener(token string, callB
 	}
 }
 
-func (sm *StateManagerImpl) AddSessionRemovedListener(token string, callBack func(token string)) RemoveListener {
+func (sm *StateManagerImpl) AddApiSessionRemovedListener(token string, callBack func(token string)) RemoveListener {
 	eventName := sm.getSessionRemovedEventName(token)
 	listener := func(args ...interface{}) {
 		callBack(token)
@@ -317,10 +335,10 @@ func (sm *StateManagerImpl) StartHeartbeat(ctrl channel2.Channel, intervalSecond
 	pfxlog.Logger().Info("heartbeat starting")
 }
 
-func (sm *StateManagerImpl) AddConnectedSession(token string, removeCB func(), ch channel2.Channel) {
+func (sm *StateManagerImpl) AddConnectedApiSession(token string, removeCB func(), ch channel2.Channel) {
 	var sessions map[channel2.Channel]func()
 
-	if val, ok := sm.activeSessions.Load(token); ok {
+	if val, ok := sm.activeApiSessions.Load(token); ok {
 		if sessions, ok = val.(map[channel2.Channel]func()); !ok {
 			pfxlog.Logger().Panic("could not convert to active sessions")
 		}
@@ -329,11 +347,11 @@ func (sm *StateManagerImpl) AddConnectedSession(token string, removeCB func(), c
 	}
 	sessions[ch] = removeCB
 
-	sm.activeSessions.Store(token, sessions)
+	sm.activeApiSessions.Store(token, sessions)
 }
 
-func (sm *StateManagerImpl) RemoveConnectedSession(token string, ch channel2.Channel) {
-	if val, ok := sm.activeSessions.Load(token); ok {
+func (sm *StateManagerImpl) RemoveConnectedApiSession(token string, ch channel2.Channel) {
+	if val, ok := sm.activeApiSessions.Load(token); ok {
 		sessions, ok := val.(map[channel2.Channel]func())
 
 		if !ok {
@@ -346,7 +364,7 @@ func (sm *StateManagerImpl) RemoveConnectedSession(token string, ch channel2.Cha
 		}
 
 		if len(sessions) == 0 {
-			sm.activeSessions.Delete(token)
+			sm.activeApiSessions.Delete(token)
 		}
 	}
 }
@@ -354,7 +372,7 @@ func (sm *StateManagerImpl) RemoveConnectedSession(token string, ch channel2.Cha
 func (sm *StateManagerImpl) ActiveSessionTokens() []string {
 	var tokens []string
 
-	sm.activeSessions.Range(func(key, _ interface{}) bool {
+	sm.activeApiSessions.Range(func(key, _ interface{}) bool {
 		if token, ok := key.(string); ok {
 			tokens = append(tokens, token)
 		} else {

router/xgress_edge/connections.go

@@ -49,9 +49,9 @@ func (handler *sessionConnectionHandler) BindChannel(ch channel2.Channel) error
 		fpg := cert.NewFingerprintGenerator()
 		fingerprints := fpg.FromCerts(certificates)
 
-		session := handler.stateManager.GetSession(token)
+		apiSession := handler.stateManager.GetApiSession(token)
 
-		if session == nil {
+		if apiSession == nil {
 			_ = ch.Close()
 
 			subjects := []string{}
@@ -63,25 +63,25 @@ func (handler *sessionConnectionHandler) BindChannel(ch channel2.Channel) error
 			return fmt.Errorf("no api session found for token [%s], fingerprints: [%v], subjects [%v]", token, fingerprints, subjects)
 		}
 
-		for _, fingerprint := range session.CertFingerprints {
+		for _, fingerprint := range apiSession.CertFingerprints {
 			if fingerprints.Contains(fingerprint) {
-				removeListener := handler.stateManager.AddSessionRemovedListener(token, func(token string) {
+				removeListener := handler.stateManager.AddApiSessionRemovedListener(token, func(token string) {
 					if !ch.IsClosed() {
 						err := ch.Close()
 
 						if err != nil {
-							pfxlog.Logger().WithError(err).Error("could not close channel during session removal")
+							pfxlog.Logger().WithError(err).Error("could not close channel during api session removal")
 						}
 					}
 				})
 
-				handler.stateManager.AddConnectedSession(token, removeListener, ch)
+				handler.stateManager.AddConnectedApiSession(token, removeListener, ch)
 
 				return nil
 			}
 		}
 		_ = ch.Close()
-		return errors.New("invalid client certificate for session")
+		return errors.New("invalid client certificate for api session")
 	}
 	_ = ch.Close()
 	return errors.New("no token attribute provided")
@@ -92,7 +92,7 @@ func (handler *sessionConnectionHandler) HandleClose(ch channel2.Channel) {
 	if byteToken, ok := ch.Underlay().Headers()[edge.SessionTokenHeader]; ok {
 		token = string(byteToken)
 
-		handler.stateManager.RemoveConnectedSession(token, ch)
+		handler.stateManager.RemoveConnectedApiSession(token, ch)
 	} else {
 		pfxlog.Logger().
 			WithField("id", ch.Id()).

router/xgress_edge/listener.go

@@ -112,7 +112,7 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha
 	}
 	log.Debug("validating network session")
 	sm := fabric.GetStateManager()
-	ns := sm.GetNetworkSessionWithTimeout(token, time.Second*5)
+	ns := sm.GetSessionWithTimeout(token, time.Second*5)
 
 	if ns == nil || ns.Type != edge_ctrl_pb.SessionType_Dial {
 		log.WithField("token", token).Error("session not found")
@@ -124,14 +124,14 @@ func (proxy *ingressProxy) processConnect(req *channel2.Message, ch channel2.Cha
 		log.WithField("token", token).
 			WithField("serviceFingerprints", ns.CertFingerprints).
 			WithField("clientFingerprints", proxy.fingerprints.Prints()).
-			Error("matching fingerprint not found")
+			Error("matching fingerprint not found for connect")
 		proxy.sendStateClosedReply("Invalid Session", req)
 		return
 	}
 
 	log.Debug("validating connection id")
 
-	removeListener := sm.AddNetworkSessionRemovedListener(ns.Token, func(token string) {
+	removeListener := sm.AddSessionRemovedListener(ns.Token, func(token string) {
 		proxy.sendStateClosed(connId, "session closed")
 		proxy.closeConn(connId)
 	})
@@ -211,7 +211,7 @@ func (proxy *ingressProxy) processBind(req *channel2.Message, ch channel2.Channe
 	}
 	log.Debug("validating network session")
 	sm := fabric.GetStateManager()
-	ns := sm.GetNetworkSessionWithTimeout(token, time.Second*5)
+	ns := sm.GetSessionWithTimeout(token, time.Second*5)
 
 	if ns == nil || ns.Type != edge_ctrl_pb.SessionType_Bind {
 		log.WithField("token", token).Error("session not found")
@@ -223,7 +223,7 @@ func (proxy *ingressProxy) processBind(req *channel2.Message, ch channel2.Channe
 		log.WithField("token", token).
 			WithField("serviceFingerprints", ns.CertFingerprints).
 			WithField("clientFingerprints", proxy.fingerprints.Prints()).
-			Error("matching fingerprint not found")
+			Error("matching fingerprint not found for bind")
 		proxy.sendStateClosedReply("Invalid Session", req)
 		return
 	}
@@ -253,7 +253,7 @@ func (proxy *ingressProxy) processBind(req *channel2.Message, ch channel2.Channe
 
 	terminatorIdRef := &concurrenz.AtomicString{}
 
-	removeListener := sm.AddNetworkSessionRemovedListener(ns.Token, func(token string) {
+	removeListener := sm.AddSessionRemovedListener(ns.Token, func(token string) {
 		terminatorId := terminatorIdRef.Get()
 		defer func() {
 			log.Debugf("removing listener for terminator %v, token: %v", terminatorId, token)
@@ -320,7 +320,7 @@ func (proxy *ingressProxy) processUnbind(req *channel2.Message, ch channel2.Chan
 	log := pfxlog.ContextLogger(ch.Label()).WithField("sessionId", token).WithFields(edge.GetLoggerFields(req))
 
 	sm := fabric.GetStateManager()
-	ns := sm.GetNetworkSession(token)
+	ns := sm.GetSession(token)
 
 	if ns == nil {
 		log.WithField("token", token).Error("session not found")
@@ -332,7 +332,7 @@ func (proxy *ingressProxy) processUnbind(req *channel2.Message, ch channel2.Chan
 		log.WithField("token", token).
 			WithField("serviceFingerprints", ns.CertFingerprints).
 			WithField("clientFingerprints", proxy.fingerprints.Prints()).
-			Error("matching fingerprint not found")
+			Error("matching fingerprint not found for unbind")
 		proxy.sendStateClosedReply("Invalid Session", req)
 		return
 	}
@@ -364,7 +364,7 @@ func (proxy *ingressProxy) processUpdateBind(req *channel2.Message, ch channel2.
 	}
 
 	sm := fabric.GetStateManager()
-	ns := sm.GetNetworkSession(token)
+	ns := sm.GetSession(token)
 
 	if ns == nil {
 		log.WithField("token", token).Error("session not found")
@@ -376,7 +376,7 @@ func (proxy *ingressProxy) processUpdateBind(req *channel2.Message, ch channel2.
 		log.WithField("token", token).
 			WithField("serviceFingerprints", ns.CertFingerprints).
 			WithField("clientFingerprints", proxy.fingerprints.Prints()).
-			Error("matching fingerprint not found")
+			Error("matching fingerprint not found for update bind")
 		proxy.sendStateClosedReply("Invalid Session", req)
 		return
 	}

specs/swagger.yml

@@ -884,12 +884,86 @@ paths:
       security:
         - ztSession: [ ]
       tags:
-        - CurrentAPI Session
+        - Current API Session
       responses:
         200:
           $ref: '#/responses/emptyResponse'
         401:
           $ref: '#/responses/unauthorizedResponse'
+  '/current-api-session/certificates':
+    get:
+      summary: List the ephemeral certificates available for the current API Session
+      description: Retrieves a list of certificate resources for the current API session; supports filtering, sorting, and pagination
+      security:
+        - ztSession: [ ]
+      tags:
+        - Current API Session
+      operationId: listCurrentApiSessionCertificates
+      parameters:
+        - $ref: '#/parameters/limit'
+        - $ref: '#/parameters/offset'
+        - $ref: '#/parameters/filter'
+      responses:
+        '200':
+          $ref: '#/responses/listCurrentApiSessionCertificates'
+    post:
+      summary: Creates an ephemeral certificate for the current API Session
+      description: Creates an ephemeral certificate for the current API Session. This endpoint
+        expects a PEM encoded CSRs to be provided for fulfillment as a property of a JSON payload.
+        It is up to the client to manage the private key backing the CSR request.
+      security:
+        - ztSession: [ ]
+      tags:
+        - Current API Session
+      operationId: createCurrentApiSessionCertificate
+      parameters:
+        - name: Body
+          in: body
+          required: true
+          description: The payload describing the CSR used to create a session certificate
+          schema:
+            $ref: '#/definitions/currentApiSessionCertificateCreate'
+      responses:
+        '200':
+          $ref: '#/responses/createCurrentApiSessionCertificateResponse'
+        '400':
+          $ref: '#/responses/badRequestResponse'
+        '401':
+          $ref: '#/responses/unauthorizedResponse'
+  '/current-api-session/certificates/{id}':
+    parameters:
+      - $ref: '#/parameters/id'
+    get:
+      summary: Retrieves an ephemeral certificate
+      description: Retrieves a single ephemeral certificate by id
+      security:
+        - ztSession: [ ]
+      tags:
+        - Current API Session
+      operationId: detailCurrentApiSessionCertificate
+      responses:
+        '200':
+          $ref: '#/responses/detailCurrentApiSessionCertificate'
+        '404':
+          $ref: '#/responses/notFoundResponse'
+        '401':
+          $ref: '#/responses/unauthorizedResponse'
+    delete:
+      summary: Delete an ephemeral certificate
+      description: |
+        Delete an ephemeral certificateby id
+      security:
+        - ztSession: [ ]
+      tags:
+        - Current API Session
+      operationId: deleteCurrentApiSessionCertificate
+      responses:
+        '200':
+          $ref: '#/responses/deleteResponse'
+        '400':
+          $ref: '#/responses/badRequestResponse'
+        '401':
+          $ref: '#/responses/unauthorizedResponse'
   '/current-identity':
     get:
       summary: Return the current identity
@@ -3464,7 +3538,18 @@ responses:
           enrollment: { }
           roleAttributes:
             $ref: '#/definitions/attributes'
-
+  listCurrentApiSessionCertificates:
+    description: A list of the current API Session's certificate
+    schema:
+      $ref: '#/definitions/listCurrentAPISessionCertificatesEnvelope'
+  createCurrentApiSessionCertificateResponse:
+    description: A response of a create API Session certificate
+    schema:
+      $ref: '#/definitions/createCurrentApiSessionCertificateEnvelope'
+  detailCurrentApiSessionCertificate:
+    description: A response containing a single API Session certificate
+    schema:
+      $ref: '#/definitions/detailCurrentApiSessionCertificateEnvelope'
   ###################################################################
   # API Session
   ##################################################################
@@ -3775,6 +3860,7 @@ responses:
     schema:
       $ref: '#/definitions/detailPostureCheckEnvelope'
 
+
 #######################################################################################################################
 #
 # Definitions - In & Out Models Only
@@ -5456,6 +5542,33 @@ definitions:
         $ref: '#/definitions/meta'
       data:
         $ref: '#/definitions/apiSessionList'
+  listCurrentAPISessionCertificatesEnvelope:
+    required:
+      - meta
+      - data
+    properties:
+      meta:
+        $ref: '#/definitions/meta'
+      data:
+        $ref: '#/definitions/currentApiSessionCertificateList'
+  createCurrentApiSessionCertificateEnvelope:
+    required:
+      - meta
+      - data
+    properties:
+      meta:
+        $ref: '#/definitions/meta'
+      data:
+        $ref: '#/definitions/currentApiSessionCertificateCreateResponse'
+  detailCurrentApiSessionCertificateEnvelope:
+    required:
+      - meta
+      - data
+    properties:
+      meta:
+        $ref: '#/definitions/meta'
+      data:
+        $ref: '#/definitions/currentApiSessionCertificateDetail'
   detailAPISessionEnvelope:
     required:
       - meta
@@ -6189,7 +6302,6 @@ definitions:
       - default
       - required
       - failed
-
   dataIntegrityCheckResultEnvelope:
     type: object
     required:
@@ -6692,4 +6804,51 @@ definitions:
             type: array
             items:
               type: string
-    x-class: "PROCESS"
+    x-class: "PROCESS"
+
+  currentApiSessionCertificateList:
+    type: array
+    items:
+      $ref: '#/definitions/currentApiSessionCertificateDetail'
+  currentApiSessionCertificateDetail:
+    type: object
+    allOf:
+      - $ref: '#/definitions/baseEntity'
+      - type: object
+        required:
+          - subject
+          - fingerprint
+          - validFrom
+          - validTo
+          - certificate
+        properties:
+          subject:
+            type: string
+          fingerprint:
+            type: string
+          validFrom:
+            type: string
+            format: date-time
+          validTo:
+            type: string
+            format: date-time
+          certificate:
+            type: string
+  currentApiSessionCertificateCreate:
+    type: object
+    required:
+      - csr
+    properties:
+      csr:
+        type: string
+  currentApiSessionCertificateCreateResponse:
+    allOf:
+      - $ref: '#/definitions/createLocation'
+      - type: object
+        required:
+          - certificate
+        properties:
+          certificate:
+            type: string
+          cas:
+            type: string

tests/api_session_certificates_test.go

@@ -0,0 +1,208 @@
+// +build apitests
+
+/*
+	Copyright NetFoundry, Inc.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+	https://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+package tests
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"github.com/Jeffail/gabs"
+	"github.com/michaelquigley/pfxlog"
+	"github.com/openziti/foundation/identity/certtools"
+	"net/http"
+	"os"
+	"testing"
+)
+
+func Test_Api_Session_Certs(t *testing.T) {
+	ctx := NewTestContext(t)
+	defer ctx.Teardown()
+	ctx.StartServer()
+
+	t.Run("as the default admin, session certs", func(t *testing.T) {
+		var createdResponseBody *gabs.Container //used across multiple subtests, set in first
+		var createdId string                    //used across multiple subtests, set in first
+
+		t.Run("can be created", func(t *testing.T) {
+			ctx.testContextChanged(t)
+			ctx.RequireAdminLogin()
+			csr, _, err := generateCsr()
+			ctx.Req.NoError(err)
+
+			csrPem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csr})
+			ctx.Req.NotEmpty(csrPem)
+
+			request := ctx.AdminSession.newAuthenticatedRequest()
+
+			body := gabs.New()
+			body.Set(string(csrPem), "csr")
+			bodyStr := body.String()
+			request.SetBody(bodyStr)
+
+			resp, err := request.Post("/current-api-session/certificates")
+
+			ctx.Req.NoError(err)
+			standardJsonResponseTests(resp, http.StatusCreated, t)
+
+			createdResponseBody, err = gabs.ParseJSON(resp.Body())
+			ctx.Req.NoError(err)
+
+			var ok bool
+			createdId, ok = createdResponseBody.Path("data.id").Data().(string)
+			ctx.Req.True(ok)
+			ctx.Req.NotEmpty(createdId)
+
+			certificate := createdResponseBody.Path("data.certificate").Data().(string)
+			ctx.Req.NotEmpty(certificate)
+
+			x509Cert, err := certtools.LoadCert([]byte(certificate))
+			ctx.Req.NotEmpty(x509Cert)
+			ctx.Req.NoError(err)
+
+		})
+
+		t.Run("can be listed", func(t *testing.T) {
+			ctx.testContextChanged(t)
+
+			resp, err := ctx.AdminSession.newAuthenticatedRequest().Get("/current-api-session/certificates")
+			ctx.Req.NoError(err)
+
+			ctx.Req.Equal(http.StatusOK, resp.StatusCode())
+
+			t.Run("list contains the API session cert", func(t *testing.T) {
+				ctx.testContextChanged(t)
+
+				bodyStr := resp.Body()
+				body, err := gabs.ParseJSON(bodyStr)
+				ctx.Req.NoError(err)
+
+				data := body.Path("data")
+				ctx.Req.NotEmpty(data)
+
+				children, err := data.Children()
+				ctx.Req.NoError(err)
+
+				ctx.Req.Len(children, 1)
+
+				subject := children[0].Path("subject").Data().(string)
+				ctx.Req.NotEmpty(subject)
+
+				fingerprint := children[0].Path("fingerprint").Data().(string)
+				ctx.Req.NotEmpty(fingerprint)
+
+				validFrom := children[0].Path("validFrom").Data().(string)
+				ctx.Req.NotEmpty(validFrom)
+
+				validTo := children[0].Path("validTo").Data().(string)
+				ctx.Req.NotEmpty(validTo)
+
+				certificate := children[0].Path("certificate").Data().(string)
+				ctx.Req.NotEmpty(certificate)
+
+				x509Cert, err := certtools.LoadCert([]byte(certificate))
+				ctx.Req.NotEmpty(x509Cert)
+				ctx.Req.NoError(err)
+			})
+		})
+
+		t.Run("can be detailed", func(t *testing.T) {
+			ctx.testContextChanged(t)
+
+			resp, err := ctx.AdminSession.newAuthenticatedRequest().Get("/current-api-session/certificates/" + createdId)
+			ctx.Req.NoError(err)
+
+			ctx.Req.Equal(http.StatusOK, resp.StatusCode())
+
+			t.Run("contains proper values", func(t *testing.T) {
+				ctx.testContextChanged(t)
+
+				bodyStr := resp.Body()
+				body, err := gabs.ParseJSON(bodyStr)
+				ctx.Req.NoError(err)
+
+				data := body.Path("data")
+				ctx.Req.NotEmpty(data)
+
+				subject := data.Path("subject").Data().(string)
+				ctx.Req.NotEmpty(subject)
+
+				fingerprint := data.Path("fingerprint").Data().(string)
+				ctx.Req.NotEmpty(fingerprint)
+
+				validFrom := data.Path("validFrom").Data().(string)
+				ctx.Req.NotEmpty(validFrom)
+
+				validTo := data.Path("validTo").Data().(string)
+				ctx.Req.NotEmpty(validTo)
+
+				certificate := data.Path("certificate").Data().(string)
+				ctx.Req.NotEmpty(certificate)
+
+				x509Cert, err := certtools.LoadCert([]byte(certificate))
+				ctx.Req.NotEmpty(x509Cert)
+				ctx.Req.NoError(err)
+			})
+		})
+
+		t.Run("can be deleted", func(t *testing.T) {
+			ctx.testContextChanged(t)
+
+			resp, err := ctx.AdminSession.newAuthenticatedRequest().Delete("/current-api-session/certificates/" + createdId)
+			ctx.Req.NoError(err)
+
+			standardJsonResponseTests(resp, http.StatusOK, t)
+		})
+	})
+}
+
+func generateCsr() ([]byte, crypto.PrivateKey, error) {
+	p384 := elliptic.P384()
+	pfxlog.Logger().Infof("generating %s EC key", p384.Params().Name)
+	privateKey, err := ecdsa.GenerateKey(p384, rand.Reader)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	hostname, err := os.Hostname()
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	request, err := certtools.NewCertRequest(map[string]string{
+		"C": "US", "O": "TEST", "CN": hostname,
+	}, nil)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	csr, err := x509.CreateCertificateRequest(rand.Reader, request, privateKey)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return csr, privateKey, nil
+}
+