security_client_rs/fleet/
enrollment.rs

1//! Enrollment API keys, which let new agents join a policy.
2use std::fmt;
3
4use serde::Deserialize;
5use serde_json::Value;
6
7use super::{Fleet, FleetPage, Item};
8use crate::{Scope, http::Method, pagination::paginated, request::endpoint};
9
10/// A Fleet enrollment key for joining agents to a policy.
11/// Enrollment credentials are omitted from `Debug` output.
12#[derive(Clone, Deserialize)]
13#[non_exhaustive]
14pub struct EnrollmentKey {
15    /// Fleet resource ID used to retrieve or revoke this enrollment key.
16    pub id: String,
17    pub api_key_id: String,
18    /// Enrollment token passed to Elastic Agent.
19    pub api_key: String,
20    pub active: bool,
21    #[serde(default)]
22    pub policy_id: Option<String>,
23    #[serde(default)]
24    pub name: Option<String>,
25    /// Absent on Kibana 9.0 to 9.3, even for keys created with an expiration.
26    #[serde(default)]
27    pub expire_at: Option<String>,
28}
29
30impl fmt::Debug for EnrollmentKey {
31    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
32        f.debug_struct("EnrollmentKey")
33            .field("id", &self.id)
34            .field("active", &self.active)
35            .field("api_key", &"[redacted]")
36            .finish_non_exhaustive()
37    }
38}
39
40impl<'a> Fleet<'a> {
41    pub fn find_enrollment_keys(&self) -> FindEnrollmentKeys<'a> {
42        FindEnrollmentKeys(self.0.request(
43            Method::GET,
44            Scope::Space,
45            &["api", "fleet", "enrollment_api_keys"],
46        ))
47    }
48
49    pub fn get_enrollment_key(&self, id: &str) -> GetEnrollmentKey<'a> {
50        GetEnrollmentKey(self.0.request(
51            Method::GET,
52            Scope::Space,
53            &["api", "fleet", "enrollment_api_keys", id],
54        ))
55    }
56
57    pub fn create_enrollment_key(&self, policy_id: &str) -> CreateEnrollmentKey<'a> {
58        CreateEnrollmentKey(
59            self.0
60                .request(
61                    Method::POST,
62                    Scope::Space,
63                    &["api", "fleet", "enrollment_api_keys"],
64                )
65                .nonempty("policy_id", policy_id)
66                .field("policy_id", policy_id),
67        )
68    }
69
70    /// Revokes future enrollment. Already enrolled agents keep their own credentials.
71    pub fn revoke_enrollment_key(&self, id: &str) -> RevokeEnrollmentKey<'a> {
72        RevokeEnrollmentKey(self.0.request(
73            Method::DELETE,
74            Scope::Space,
75            &["api", "fleet", "enrollment_api_keys", id],
76        ))
77    }
78}
79
80endpoint! {
81    /// `GET /api/fleet/enrollment_api_keys`
82    FindEnrollmentKeys => FleetPage<EnrollmentKey>
83}
84
85endpoint! {
86    /// `GET /api/fleet/enrollment_api_keys/{keyId}`
87    GetEnrollmentKey => Item<EnrollmentKey>
88}
89
90endpoint! {
91    /// `POST /api/fleet/enrollment_api_keys`
92    CreateEnrollmentKey => Item<EnrollmentKey>
93}
94
95impl CreateEnrollmentKey<'_> {
96    pub fn name(self, name: &str) -> Self {
97        Self(self.0.field("name", name))
98    }
99
100    /// An Elastic duration after which the key expires, for example `24h`.
101    pub fn expiration(self, duration: &str) -> Self {
102        Self(self.0.field("expiration", duration))
103    }
104}
105
106endpoint! {
107    /// `DELETE /api/fleet/enrollment_api_keys/{keyId}`
108    RevokeEnrollmentKey => Value
109}
110
111page_setters!(FindEnrollmentKeys);
112paginated!(FindEnrollmentKeys => FleetPage<EnrollmentKey>);
security_client_rs/fleet/enrollment.rs

security_client_rs/fleet/
enrollment.rs
