AuthBox PIVPublic page · no certificate presented
Operations this service exposes. Generated from the published specification, which describes what the API accepts and returns and not who is permitted to call it — those requirements are removed from the published document.
| Method | Path | Operation | Summary |
|---|---|---|---|
DELETE | /admin/v1/enrollments/{id} |
deleteEnrollment | Discard a request from the queue |
DELETE | /admin/v1/entities/{dn} |
deleteEntity | Remove an entity |
DELETE | /admin/v1/entities/{dn}/access/{role}/{member} |
removeAccess | Remove from an access list — the same role addition takes |
DELETE | /admin/v1/entities/{dn}/attributes/{name} |
deleteAttribute | Remove one attribute from an entity |
DELETE | /admin/v1/entities/{dn}/marking |
deleteEntityMarking | Remove one entity's declared marking |
DELETE | /admin/v1/entities/{dn}/members/{member} |
removeMember | Remove a member — editor, the same role addition takes |
DELETE | /admin/v1/entities/{dn}/missions/{mission} |
removeMissionBinding | Unbind a mission from this group |
DELETE | /admin/v1/entities/{dn}/webauthn-signers/{credential_id} |
deleteWebAuthnSigner | Remove a browser key — an operator's act, and deliberately unsigned |
DELETE | /admin/v1/grants/{id} |
revokeGrant | Revoke a grant — which is deleting it |
DELETE | /admin/v1/invitations/{id} |
deleteInvitation | Revoke an invitation |
DELETE | /admin/v1/missions/{id} |
deleteMission | Remove a mission, unless a group still binds it |
DELETE | /admin/v1/obligations/{id} |
deleteObligation | Retire an obligation |
DELETE | /admin/v1/requests/{id} |
withdrawRequest | The requester takes their own request back |
GET | /admin/v1/audit |
getAudit | The tail of the decision record, with the chain verified across all of it |
GET | /admin/v1/audit/export |
exportAuditSegment | One sealed audit segment, signed by the audit anchor key, for a SIEM to verify itself |
GET | /admin/v1/certificates |
listCertificates | The issuance ledger — every certificate this deployment signed, newest first |
GET | /admin/v1/enrollments |
listEnrollments | The CSR approval queue |
GET | /admin/v1/enrollments/mine |
listMyEnrollments | The caller's own enrolment requests — no subject parameter, by design |
GET | /admin/v1/enrollments/{id} |
getEnrollment | One request, including the certificate request the list omits |
GET | /admin/v1/entities |
listEntities | List entities by canonical DN, filtered to what the caller may see |
GET | /admin/v1/entities/{dn} |
getEntity | Fetch one entity |
GET | /admin/v1/entities/{dn}/history |
entityHistory | One entity's story, projected from the records that already hold it |
GET | /admin/v1/entities/{dn}/kind |
getEntityKind | What one NAMED subject is — and nothing else about it |
GET | /admin/v1/entities/{dn}/webauthn-signers |
listWebAuthnSigners | The browser keys this entity may add a second signature with |
GET | /admin/v1/goals |
listGoals | The compliance targets this deployment has set itself, and how much of each tree meets them |
GET | /admin/v1/goals/{id} |
reportGoal | One goal's roll-up, per unit of its tree, with the obligations and clauses that are short |
GET | /admin/v1/grants |
listGrants | Every per-subject grant, and whether it is live right now |
GET | /admin/v1/groups |
listGroups | List groups the caller may see, with their resolved mission sets |
GET | /admin/v1/groups/{dn} |
getGroup | One group, including which missions each tag selector matched |
GET | /admin/v1/health |
getHealth | Loaded versions, backend capabilities, CRL freshness, dataset warnings |
GET | /admin/v1/invitations |
listInvitations | The invitations this deployment holds, metadata only |
GET | /admin/v1/invitations/{id} |
getInvitation | One invitation's metadata by id, metadata only |
GET | /admin/v1/memberships/{dn} |
getMemberships | The groups an entity is a direct member of, filtered to what the caller may see |
GET | /admin/v1/metrics |
getMetrics | Prometheus text exposition of this deployment's own metrics |
GET | /admin/v1/missions |
listMissions | List missions |
GET | /admin/v1/missions/{id} |
getMission | One mission, its restrictions, and whether it is currently valid |
GET | /admin/v1/names |
listNames | The DNS zones this deployment holds — its own and every adopted authority's |
GET | /admin/v1/obligations |
listObligations | The standing compliance requirements, and whether anything enforces each |
GET | /admin/v1/obligations/{id}/report |
reportObligation | Who in this population is out of compliance, on which clause, and why |
GET | /admin/v1/openapi.yaml |
getSpecification | This document |
GET | /admin/v1/replica/bundle |
getReplicaBundle | This writer's own most recently published replica bundle |
GET | /admin/v1/reports/can/policies |
listCanPolicies | Every requirement this deployment enforces, in one grammar |
GET | /admin/v1/requests |
listRequests | The request board — every request, decided and undecided |
GET | /admin/v1/requests/mine |
listMyRequests | The caller's own requests — no subject parameter, by design |
GET | /admin/v1/requests/{id} |
getRequest | One request, at the board's own posture |
GET | /admin/v1/revocation-requests |
listRevocationRequests | The revocation request queue, newest first |
GET | /admin/v1/settings |
getSettings | The configuration in force, with provenance and tiers |
GET | /admin/v1/status |
getStatus | The operational picture — upstreams, cached projects, replica, OCSP, ACME, OIDC |
GET | /admin/v1/sync/bundle |
getSyncBundle | This instance's own most recently published authority bundle |
GET | /admin/v1/sync/index |
getSyncIndex | The signed index of authorities this instance can hand out |
GET | /admin/v1/topology |
getTopology | This box's own view of the chain it sits in, for a neighbouring box's admin |
GET | /admin/v1/version |
getVersion | This binary's build identity, the dataset schema window it reads, and the version of each OpenAPI document it serves |
POST | /admin/v1/attest/nonce |
issueAttestNonce | A short-lived, single-use challenge for a signature-required operation |
POST | /admin/v1/audit/doors |
acceptDoorAuditSegment | One front door's sealed audit segment, handed up to its writer |
POST | /admin/v1/audit/rotate |
rotateAudit | Close the active segment with a seal and open a fresh one, chained from it |
POST | /admin/v1/certificates/{serial}/revoke-request |
requestRevocation | Record an intent that a certificate be revoked |
POST | /admin/v1/enrollments/{id}/approve |
approveEnrollment | Approve a request and issue the certificate |
POST | /admin/v1/enrollments/{id}/reject |
rejectEnrollment | Refuse a request |
POST | /admin/v1/entities/{dn}/access/{role} |
addAccess | Add to an access list — admin, or owner for the owners list |
POST | /admin/v1/entities/{dn}/members |
addMember | Add a member — editor, because membership is who may USE the group |
POST | /admin/v1/entities/{dn}/missions |
addMissionBinding | Bind a mission to this group |
POST | /admin/v1/entities/{dn}/reinstate |
reinstateEntity | Lift a suspension — and render what comes back live |
POST | /admin/v1/entities/{dn}/suspend |
suspendEntity | Pause an entity — preserving everything it holds, and recording why |
POST | /admin/v1/entities/{dn}/webauthn-signers |
registerWebAuthnSigner | Register a browser key — self-only, and signature-required for the reason it exists |
POST | /admin/v1/goals/{id}/snapshot |
snapshotGoal | Append this goal's roll-up to the audit chain now, as your act |
POST | /admin/v1/groups/{dn}/missions/new |
createProjectMission | Create a mission this project owns — the project's admins, within their own standing |
POST | /admin/v1/groups/{dn}/services/new |
createProjectService | Give a service an identity this project owns — the project's admins, within their own standing |
POST | /admin/v1/groups/{dn}/services/{name}/revoke-request |
requestProjectServiceRevocation | Withdraw what this project's own service holds — the project's admins, within their own standing |
POST | /admin/v1/invitations |
createInvitation | Create an invitation and return its token exactly once |
POST | /admin/v1/reports/access |
reportAccess | Would this subject pass this operation, optionally with extra memberships? |
POST | /admin/v1/reports/can |
reportCan | Can this subject do this — through that door, under that mission? |
POST | /admin/v1/reports/can/batch |
reportCanBatch | Up to sixty-four questions, answered in order |
POST | /admin/v1/requests |
fileRequest | Ask for a mission — any authenticated subject, for a discoverable mission |
POST | /admin/v1/requests/{id}/accept |
acceptRequest | The requester's half — signature required, from day one |
POST | /admin/v1/requests/{id}/assign |
assignRequest | The approver's half — creates the grant with its window |
POST | /admin/v1/requests/{id}/refuse |
refuseRequest | The approver declines it |
PUT | /admin/v1/entities/{dn} |
putEntity | Create or replace an entity |
PUT | /admin/v1/entities/{dn}/attributes/{name} |
setAttribute | Set one attribute on an entity |
PUT | /admin/v1/entities/{dn}/marking |
setEntityMarking | Classify one entity — who may know this record exists |
PUT | /admin/v1/groups/{dn}/services/{name}/route |
setProjectServiceRoute | Point this project's own service at an upstream — the project's admins, within their own standing |
PUT | /admin/v1/missions/{id} |
putMission | Create or replace a mission |
PUT | /admin/v1/missions/{id}/details |
editProjectMissionDetails | A project mission's name, tags, approvers and discoverability — and nothing else |
PUT | /admin/v1/obligations/{id} |
putObligation | Create or replace a standing compliance requirement |
The full document is at /openapi.yaml.
Looking for the documentation rather than the API? Getting started, the deployment scenarios and the user guide are served by this box too.