ziti/specs/source/shared/current-identity-authenticators.yml

---

paths:
  current-identity-authenticators:
    get:
      summary: List authenticators for the current identity
      description: Retrieves a list of authenticators assigned to the current API session's identity; supports filtering, sorting, and pagination.
      security:
        - ztSession: [ ]
      tags:
        - Current API Session
      operationId: listCurrentIdentityAuthenticators
      parameters:
        - $ref: 'parameters.yml#/limit'
        - $ref: 'parameters.yml#/offset'
        - $ref: 'parameters.yml#/filter'
      responses:
        '200':
          $ref: 'authenticators.yml#/responses/listAuthenticators'
        '401':
          $ref: 'standard-responses.yml#/responses/unauthorizedResponse'
        '400':
          $ref: '../shared/standard-responses.yml#/responses/badRequestResponse'
  current-identity-authenticators-id:
    parameters:
      - $ref: 'parameters.yml#/id'
    get:
      summary: Retrieve an authenticator for the current identity
      description: Retrieves a single authenticator by id. Will only show authenticators assigned to the API session's identity.
      security:
        - ztSession: [ ]
      tags:
        - Current API Session
      operationId: detailCurrentIdentityAuthenticator
      responses:
        '200':
          $ref: 'authenticators.yml#/responses/detailAuthenticator'
        '404':
          $ref: 'standard-responses.yml#/responses/notFoundResponse'
        '401':
          $ref: 'standard-responses.yml#/responses/unauthorizedResponse'
    put:
      summary: Update all fields on an authenticator of this identity
      description: |
        Update all fields on an authenticator by id.  Will only update authenticators assigned to the API session's
        identity.
      security:
        - ztSession: [ ]
      tags:
        - Current API Session
      operationId: updateCurrentIdentityAuthenticator
      parameters:
        - name: authenticator
          in: body
          required: true
          description: 'An authenticator put object'
          schema:
            $ref: 'authenticators.yml#/definitions/authenticatorUpdateWithCurrent'
      responses:
        '200':
          $ref: 'standard-responses.yml#/responses/updateResponse'
        '400':
          $ref: 'standard-responses.yml#/responses/badRequestResponse'
        '404':
          $ref: 'standard-responses.yml#/responses/notFoundResponse'
        '401':
          $ref: 'standard-responses.yml#/responses/unauthorizedResponse'
    patch:
      summary: Update the supplied fields on an authenticator of this identity
      description: |
        Update the supplied fields on an authenticator by id. Will only update authenticators assigned to the API
        session's identity.
      security:
        - ztSession: [ ]
      tags:
        - Current API Session
      operationId: patchCurrentIdentityAuthenticator
      parameters:
        - name: authenticator
          in: body
          required: true
          description: An authenticator patch object
          schema:
            $ref: 'authenticators.yml#/definitions/authenticatorPatchWithCurrent'
      responses:
        '200':
          $ref: 'standard-responses.yml#/responses/patchResponse'
        '400':
          $ref: 'standard-responses.yml#/responses/badRequestResponse'
        '404':
          $ref: 'standard-responses.yml#/responses/notFoundResponse'
        '401':
          $ref: 'standard-responses.yml#/responses/unauthorizedResponse'
  current-identity-authenticators-id-extend:
    parameters:
      - $ref: 'parameters.yml#/id'
    post:
      summary: Allows the current identity to recieve a new certificate associated with a certificate based authenticator
      description: >-
        Allows an identity to extend its certificate's expiration date by
        using its current and valid client certificate to submit a CSR. This CSR may
        be passed in using a new private key, thus allowing private key rotation.

        After completion any new connections must be made with certificates returned from a 200 OK
        response. The previous client certificate is rendered invalid for use with the controller even if it
        has not expired.

        This request must be made using the existing, valid, client certificate.
      security:
        - ztSession: [ ]
      operationId: extendCurrentIdentityAuthenticator
      parameters:
        - name: extend
          in: body
          required: true
          schema:
            $ref: '#/definitions/identityExtendEnrollmentRequest'
      tags:
        - Current API Session
        - Enroll
        - Extend Enrollment
      responses:
        '200':
          $ref: '#/responses/identityExtendEnrollmentResponse'
        '401':
          $ref: '../shared/standard-responses.yml#/responses/unauthorizedResponse'

responses:
  identityExtendEnrollmentResponse:
    description: A response containg the identity's new certificate
    schema:
      $ref: '#/definitions/identityExtendEnrollmentEnvelope'

definitions:
  identityExtendEnrollmentRequest:
    type: object
    required:
      - clientCertCsr
    properties:
      clientCertCsr:
        type: string
  identityExtendEnrollmentEnvelope:
    type: object
    properties:
      meta:
        $ref: '../shared/standard-responses.yml#/definitions/meta'
      data:
        $ref: '#/definitions/identityExtendCerts'
  identityExtendCerts:
    type: object
    properties:
      clientCert:
        type: string
        description: A PEM encoded client certificate
      ca:
        type: string
        description: A PEM encoded set of CA certificates