vaultrs/api/pki/
requests.rs

1use super::responses::{
2    CrossSignResponse, GenerateCertificateResponse, GenerateIntermediateCSRResponse,
3    GenerateIntermediateResponse, GenerateRootResponse, ImportIssuerResponse,
4    ListCertificatesResponse, ListIssuersResponse, ListRolesResponse, ReadCRLConfigResponse,
5    ReadCertificateResponse, ReadIssuerCertificateResponse, ReadRoleResponse, ReadURLsResponse,
6    RevokeCertificateResponse, RotateCRLsResponse, SetDefaultIssuerResponse,
7    SignCertificateResponse, SignIntermediateIssuerResponse, SignIntermediateResponse,
8    SignSelfIssuedResponse, UpdateIssuerResponse,
9};
10use rustify_derive::Endpoint;
11use serde::Serialize;
12
13/// ## Submit CA Information
14/// This endpoint allows submitting the CA information for the backend via a PEM
15/// file containing the CA certificate and its private key, concatenated.
16///
17/// * Path: {self.mount}/config/ca
18/// * Method: POST
19/// * Response: N/A
20/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#submit-ca-information>
21
22#[derive(Builder, Debug, Default, Endpoint)]
23#[endpoint(path = "{self.mount}/config/ca", method = "POST", builder = "true")]
24#[builder(setter(into, strip_option), default)]
25pub struct SubmitCARequest {
26    #[endpoint(skip)]
27    pub mount: String,
28    pub pem_bundle: String,
29}
30
31/// ## Generate Root
32/// <https://developer.hashicorp.com/vault/api-docssecret/pki#generate-root>
33/// This endpoint generates a new self-signed CA certificate and private key. If
34/// the path ends with exported, the private key will be returned in the
35/// response; if it is internal the private key will not be returned and cannot
36/// be retrieved later.
37///
38/// * Path: {self.mount}/root/generate/{self.cert_type}
39/// * Method: POST
40/// * Response: [`Option<GenerateRootResponse>`]
41/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#generate-root>
42#[derive(Builder, Debug, Default, Endpoint)]
43#[endpoint(
44    path = "{self.mount}/root/generate/{self.cert_type}",
45    method = "POST",
46    response = "Option<GenerateRootResponse>",
47    builder = "true"
48)]
49#[builder(setter(into, strip_option), default)]
50pub struct GenerateRootRequest {
51    #[endpoint(skip)]
52    pub mount: String,
53    #[endpoint(skip)]
54    pub cert_type: String,
55    pub alt_names: Option<String>,
56    pub common_name: Option<String>,
57    pub country: Option<Vec<String>>,
58    pub exclude_cn_from_sans: Option<bool>,
59    pub format: Option<String>,
60    pub locality: Option<Vec<String>>,
61    pub key_bits: Option<u64>,
62    pub key_type: Option<String>,
63    pub ip_sans: Option<String>,
64    pub max_path_length: Option<i32>,
65    pub organization: Option<Vec<String>>,
66    pub other_sans: Option<Vec<String>>,
67    pub ou: Option<Vec<String>>,
68    pub permitted_dns_domains: Vec<String>,
69    pub postal_code: Option<Vec<String>>,
70    pub private_key_format: Option<String>,
71    pub province: Option<Vec<String>>,
72    pub serial_number: Option<String>,
73    pub street_address: Option<Vec<String>>,
74    pub ttl: Option<String>,
75    pub uri_sans: Option<String>,
76}
77
78/// ## Delete Root
79/// This endpoint deletes the current CA key (the old CA certificate will still
80/// be accessible for reading until a new certificate/key is generated or
81/// uploaded).
82///
83/// * Path: {self.mount}/root
84/// * Method: DELETE
85/// * Response: N/A
86/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#delete-root>
87#[derive(Builder, Debug, Default, Endpoint)]
88#[endpoint(path = "{self.mount}/root", method = "DELETE", builder = "true")]
89#[builder(setter(into, strip_option), default)]
90pub struct DeleteRootRequest {
91    #[endpoint(skip)]
92    pub mount: String,
93}
94
95/// ## Sign Certificate
96/// This endpoint signs a new certificate based upon the provided CSR and the
97/// supplied parameters, subject to the restrictions contained in the role named
98/// in the endpoint. The issuing CA certificate is returned as well, so that
99/// only the root CA need be in a client's trust store.
100///
101/// * Path: {self.mount}/sign/{self.role}
102/// * Method: POST
103/// * Response: [SignCertificateResponse]
104/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#sign-certificate>
105#[derive(Builder, Debug, Default, Endpoint)]
106#[endpoint(
107    path = "{self.mount}/sign/{self.role}",
108    method = "POST",
109    response = "SignCertificateResponse",
110    builder = "true"
111)]
112#[builder(setter(into, strip_option), default)]
113pub struct SignCertificateRequest {
114    #[endpoint(skip)]
115    pub mount: String,
116    #[endpoint(skip)]
117    pub role: String,
118    pub alt_names: Option<String>,
119    pub common_name: Option<String>,
120    pub csr: Option<String>,
121    pub exclude_cn_from_sans: Option<bool>,
122    pub format: Option<String>,
123    pub ip_sans: Option<String>,
124    pub other_sans: Option<Vec<String>>,
125    pub serial_number: Option<String>,
126    pub ttl: Option<String>,
127    pub uri_sans: Option<String>,
128    pub remove_roots_from_chain: Option<bool>,
129}
130
131/// ## Sign Intermediate
132/// This endpoint uses the configured CA certificate to issue a certificate with
133/// appropriate values for acting as an intermediate CA.
134///
135/// * Path: {self.mount}/root/sign-intermediate
136/// * Method: POST
137/// * Response: [SignIntermediateResponse]
138/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#sign-intermediate>
139#[derive(Builder, Debug, Default, Endpoint)]
140#[endpoint(
141    path = "{self.mount}/root/sign-intermediate",
142    method = "POST",
143    response = "SignIntermediateResponse",
144    builder = "true"
145)]
146#[builder(setter(into, strip_option), default)]
147pub struct SignIntermediateRequest {
148    #[endpoint(skip)]
149    pub mount: String,
150    pub alt_names: Option<String>,
151    pub common_name: Option<String>,
152    pub country: Option<Vec<String>>,
153    pub csr: Option<String>,
154    pub exclude_cn_from_sans: Option<bool>,
155    pub format: Option<String>,
156    pub locality: Option<Vec<String>>,
157    pub ip_sans: Option<String>,
158    pub max_path_length: Option<i32>,
159    pub organization: Option<Vec<String>>,
160    pub other_sans: Option<Vec<String>>,
161    pub ou: Option<Vec<String>>,
162    pub permitted_dns_domains: Option<Vec<String>>,
163    pub postal_code: Option<Vec<String>>,
164    pub province: Option<Vec<String>>,
165    pub serial_number: Option<String>,
166    pub street_address: Option<Vec<String>>,
167    pub ttl: Option<String>,
168    pub uri_sans: Option<String>,
169    pub use_csr_values: Option<bool>,
170}
171
172/// ## Sign Self-Issued
173/// This endpoint uses the configured CA certificate to sign a self-issued
174/// certificate (which will usually be a self-signed certificate as well).
175///
176/// * Path: {self.mount}/root/sign-self-issued
177/// * Method: POST
178/// * Response: [SignSelfIssuedResponse]
179/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#sign-intermediate>
180#[derive(Builder, Debug, Default, Endpoint)]
181#[endpoint(
182    path = "{self.mount}/root/sign-self-issued",
183    method = "POST",
184    response = "SignSelfIssuedResponse",
185    builder = "true"
186)]
187#[builder(setter(into, strip_option), default)]
188pub struct SignSelfIssuedRequest {
189    #[endpoint(skip)]
190    pub mount: String,
191    pub certificate: String,
192}
193
194/// ## List Certificates
195/// This endpoint returns a list of the current certificates by serial number
196/// only.
197///
198/// * Path: {self.mount}/certs
199/// * Method: LIST
200/// * Response: [ListCertificatesResponse]
201/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#list-certificates>
202#[derive(Builder, Debug, Default, Endpoint)]
203#[endpoint(
204    path = "{self.mount}/certs",
205    method = "LIST",
206    response = "ListCertificatesResponse",
207    builder = "true"
208)]
209#[builder(setter(into, strip_option), default)]
210pub struct ListCertificatesRequest {
211    #[endpoint(skip)]
212    pub mount: String,
213}
214
215/// ## Read Certificate
216/// This endpoint retrieves one of a selection of certificates. This endpoint
217/// returns the certificate in PEM formatting in the certificate key of the JSON
218/// object, which is a standard Vault response that is readable by the Vault
219/// CLI.
220///
221/// * Path: {self.mount}/cert/{self.serial}
222/// * Method: GET
223/// * Response: [ReadCertificateResponse]
224/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#read-certificate>
225#[derive(Builder, Debug, Default, Endpoint)]
226#[endpoint(
227    path = "{self.mount}/cert/{self.serial}",
228    response = "ReadCertificateResponse",
229    builder = "true"
230)]
231#[builder(setter(into, strip_option), default)]
232pub struct ReadCertificateRequest {
233    #[endpoint(skip)]
234    pub mount: String,
235    #[endpoint(skip)]
236    pub serial: String,
237}
238
239/// ## Generate Certificate
240/// This endpoint generates a new set of credentials (private key and
241/// certificate) based on the role named in the endpoint. The issuing CA
242/// certificate is returned as well, so that only the root CA need be in a
243/// client's trust store.
244///
245/// * Path: {self.mount}/issue/{self.role}
246/// * Method: POST
247/// * Response: [GenerateCertificateResponse]
248/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#read-certificate>
249#[derive(Builder, Debug, Default, Endpoint)]
250#[endpoint(
251    path = "{self.mount}/issue/{self.role}",
252    method = "POST",
253    response = "GenerateCertificateResponse",
254    builder = "true"
255)]
256#[builder(setter(into, strip_option), default)]
257pub struct GenerateCertificateRequest {
258    #[endpoint(skip)]
259    pub mount: String,
260    #[endpoint(skip)]
261    pub role: String,
262    pub alt_names: Option<String>,
263    pub common_name: Option<String>,
264    pub exclude_cn_from_sans: Option<bool>,
265    pub format: Option<String>,
266    pub ip_sans: Option<String>,
267    pub other_sans: Option<Vec<String>>,
268    pub private_key_format: Option<String>,
269    pub ttl: Option<String>,
270    pub uri_sans: Option<String>,
271    pub remove_roots_from_chain: Option<bool>,
272}
273
274/// ## Revoke Certificate
275/// This endpoint revokes a certificate using its serial number. This is an
276/// alternative option to the standard method of revoking using Vault lease IDs.
277/// A successful revocation will rotate the CRL.
278///
279/// * Path: {self.mount}/revoke
280/// * Method: POST
281/// * Response: [RevokeCertificateResponse]
282/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#revoke-certificate>
283#[derive(Builder, Debug, Default, Endpoint)]
284#[endpoint(
285    path = "{self.mount}/revoke",
286    method = "POST",
287    response = "RevokeCertificateResponse",
288    builder = "true"
289)]
290#[builder(setter(into, strip_option), default)]
291pub struct RevokeCertificateRequest {
292    #[endpoint(skip)]
293    pub mount: String,
294    pub serial_number: String,
295}
296
297/// ## Read CRL Configuration
298/// This endpoint allows getting the duration for which the generated CRL should
299/// be marked valid.
300///
301/// * Path: {self.mount}/config/crl
302/// * Method: GET
303/// * Response: [ReadCRLConfigResponse]
304/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#read-crl-configuration>
305#[derive(Builder, Debug, Default, Endpoint)]
306#[endpoint(
307    path = "{self.mount}/config/crl",
308    response = "ReadCRLConfigResponse",
309    builder = "true"
310)]
311#[builder(setter(into, strip_option), default)]
312pub struct ReadCRLConfigRequest {
313    #[endpoint(skip)]
314    pub mount: String,
315}
316
317/// ## Set CRL Configuration
318/// This endpoint allows setting the duration for which the generated CRL should
319/// be marked valid. If the CRL is disabled, it will return a signed but
320/// zero-length CRL for any request. If enabled, it will re-build the CRL.
321///
322/// * Path: {self.mount}/config/crl
323/// * Method: POST
324/// * Response: N/A
325/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#set-crl-configuration>
326#[derive(Builder, Debug, Default, Endpoint)]
327#[endpoint(path = "{self.mount}/config/crl", method = "POST", builder = "true")]
328#[builder(setter(into, strip_option), default)]
329pub struct SetCRLConfigRequest {
330    #[endpoint(skip)]
331    pub mount: String,
332    pub expiry: Option<String>,
333    pub disable: Option<bool>,
334    pub ocsp_disable: Option<bool>,
335    pub ocsp_expiry: Option<String>,
336    pub auto_rebuild: Option<bool>,
337    pub auto_rebuild_grace_period: Option<String>,
338    pub enable_delta: Option<bool>,
339    pub delta_rebuild_interval: Option<String>,
340}
341
342/// ## Rotate CRLs
343/// This endpoint forces a rotation of the CRL. This can be used by
344/// administrators to cut the size of the CRL if it contains a number of
345/// certificates that have now expired, but has not been rotated due to no
346/// further certificates being revoked.
347///
348/// * Path: {self.mount}/crl/rotate
349/// * Method: GET
350/// * Response: [RotateCRLsResponse]
351/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#rotate-crls>
352#[derive(Builder, Debug, Default, Endpoint)]
353#[endpoint(
354    path = "{self.mount}/crl/rotate",
355    response = "RotateCRLsResponse",
356    builder = "true"
357)]
358#[builder(setter(into, strip_option), default)]
359pub struct RotateCRLsRequest {
360    #[endpoint(skip)]
361    pub mount: String,
362}
363
364/// ## Read URLs
365/// This endpoint fetches the URLs to be encoded in generated certificates.
366///
367/// * Path: {self.mount}/config/urls
368/// * Method: GET
369/// * Response: [ReadURLsResponse]
370/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#read-urls>
371#[derive(Builder, Debug, Default, Endpoint)]
372#[endpoint(
373    path = "{self.mount}/config/urls",
374    response = "ReadURLsResponse",
375    builder = "true"
376)]
377#[builder(setter(into, strip_option), default)]
378pub struct ReadURLsRequest {
379    #[endpoint(skip)]
380    pub mount: String,
381}
382
383/// ## Set URLs
384/// This endpoint allows setting the issuing certificate endpoints, CRL
385/// distribution points, and OCSP server endpoints that will be encoded into
386/// issued certificates.
387///
388/// * Path: {self.mount}/config/urls
389/// * Method: POST
390/// * Response: N/A
391/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#set-urls>
392#[derive(Builder, Debug, Default, Endpoint)]
393#[endpoint(path = "{self.mount}/config/urls", method = "POST", builder = "true")]
394#[builder(setter(into, strip_option), default)]
395pub struct SetURLsRequest {
396    #[endpoint(skip)]
397    pub mount: String,
398    pub issuing_certificates: Option<Vec<String>>,
399    pub crl_distribution_points: Option<Vec<String>>,
400    pub ocsp_servers: Option<Vec<String>>,
401}
402
403/// ## Generate Intermediate
404/// This endpoint generates a new private key and a CSR for signing. If using
405/// Vault as a root, and for many other CAs, the various parameters on the final
406/// certificate are set at signing time and may or may not honor the parameters
407/// set here.
408///
409/// * Path: {self.mount}/intermediate/generate/{self.cert_type}
410/// * Method: POST
411/// * Response: [GenerateIntermediateResponse]
412/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#generate-intermediate>
413#[derive(Builder, Debug, Default, Endpoint)]
414#[endpoint(
415    path = "{self.mount}/intermediate/generate/{self.cert_type}",
416    method = "POST",
417    response = "GenerateIntermediateResponse",
418    builder = "true"
419)]
420#[builder(setter(into, strip_option), default)]
421pub struct GenerateIntermediateRequest {
422    #[endpoint(skip)]
423    pub mount: String,
424    #[endpoint(skip)]
425    pub cert_type: String,
426    pub alt_names: Option<String>,
427    pub common_name: Option<String>,
428    pub country: Option<Vec<String>>,
429    pub exclude_cn_from_sans: Option<bool>,
430    pub format: Option<String>,
431    pub locality: Option<Vec<String>>,
432    pub key_type: Option<String>,
433    pub key_name: Option<String>,
434    pub key_ref: Option<String>,
435    pub key_bits: Option<u64>,
436    pub signature_bits: Option<u64>,
437    pub key_format: Option<String>,
438    pub ip_sans: Option<String>,
439    pub organization: Option<Vec<String>>,
440    pub other_sans: Option<Vec<String>>,
441    pub ou: Option<Vec<String>>,
442    pub postal_code: Option<Vec<String>>,
443    pub private_key_format: Option<String>,
444    pub province: Option<Vec<String>>,
445    pub serial_number: Option<String>,
446    pub street_address: Option<Vec<String>>,
447    pub uri_sans: Option<String>,
448    pub add_basic_constrains: Option<bool>,
449}
450
451/// ## Set Signed Intermediate
452/// This endpoint allows submitting the signed CA certificate corresponding to a
453/// private key generated via /pki/intermediate/generate. The certificate should
454/// be submitted in PEM format.
455///
456/// * Path: {self.mount}/intermediate/set-signed
457/// * Method: POST
458/// * Response: [ImportIssuerResponse]
459/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#set-signed-intermediate>
460#[derive(Builder, Debug, Default, Endpoint)]
461#[endpoint(
462    path = "{self.mount}/intermediate/set-signed",
463    method = "POST",
464    builder = "true",
465    response = "ImportIssuerResponse"
466)]
467#[builder(setter(into, strip_option), default)]
468pub struct SetSignedIntermediateRequest {
469    #[endpoint(skip)]
470    pub mount: String,
471    pub certificate: String,
472}
473
474/// ## Generate intermediate CSR
475/// This endpoint returns a new CSR for signing.
476///
477/// * Path: {self.mount}/intermediate/cross-sign
478/// * Method: POST
479/// * Response: [CrossSignResponse]
480/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#generate-intermediate-csr
481#[derive(Builder, Debug, Default, Endpoint, Serialize)]
482#[endpoint(
483    path = "{self.mount}/intermediate/cross-sign",
484    method = "POST",
485    response = "CrossSignResponse",
486    builder = "true"
487)]
488#[builder(setter(into, strip_option), default)]
489pub struct CrossSignRequest {
490    #[endpoint(skip)]
491    pub mount: String,
492    pub add_basic_constraints: Option<bool>,
493    pub alt_names: Option<String>,
494    #[serde(rename = "type")]
495    pub cert_type: String,
496    pub common_name: Option<String>,
497    pub country: Option<Vec<String>>,
498    pub exclude_cn_from_sans: Option<bool>,
499    pub format: Option<String>,
500    pub ip_sans: Option<String>,
501    pub key_bits: Option<u64>,
502    pub key_name: Option<String>,
503    pub key_ref: Option<String>,
504    pub key_type: Option<String>,
505    pub locality: Option<Vec<String>>,
506    pub organization: Option<Vec<String>>,
507    pub other_sans: Option<Vec<String>>,
508    pub ou: Option<Vec<String>>,
509    pub postal_code: Option<Vec<String>>,
510    pub private_key_format: Option<String>,
511    pub province: Option<Vec<String>>,
512    pub serial_number: Option<String>,
513    pub signature_bits: u16,
514    pub street_address: Option<Vec<String>>,
515    pub uri_sans: Option<String>,
516}
517
518/// ## List Roles
519/// This endpoint returns a list of available roles. Only the role names are
520/// returned, not any values.
521///
522/// * Path: {self.mount}/roles
523/// * Method: LIST
524/// * Response: [ListRolesResponse]
525/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#list-roles>
526#[derive(Builder, Debug, Default, Endpoint)]
527#[endpoint(
528    path = "{self.mount}/roles",
529    method = "LIST",
530    response = "ListRolesResponse",
531    builder = "true"
532)]
533#[builder(setter(into, strip_option), default)]
534pub struct ListRolesRequest {
535    #[endpoint(skip)]
536    pub mount: String,
537}
538
539/// ## Read Role
540/// This endpoint queries the role definition.
541///
542/// * Path: {self.mount}/roles/{self.name}
543/// * Method: GET
544/// * Response: [ReadRoleResponse]
545/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#read-role>
546#[derive(Builder, Debug, Default, Endpoint)]
547#[endpoint(
548    path = "{self.mount}/roles/{self.name}",
549    response = "ReadRoleResponse",
550    builder = "true"
551)]
552#[builder(setter(into, strip_option), default)]
553pub struct ReadRoleRequest {
554    #[endpoint(skip)]
555    pub mount: String,
556    #[endpoint(skip)]
557    pub name: String,
558}
559
560/// ## Create/Update Role
561/// This endpoint creates or updates the role definition.
562///
563/// * Path: {self.mount}/roles/{self.name}
564/// * Method: POST
565/// * Response: N/A
566/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#create-update-role>
567#[derive(Builder, Debug, Default, Endpoint)]
568#[endpoint(
569    path = "{self.mount}/roles/{self.name}",
570    method = "POST",
571    builder = "true"
572)]
573#[builder(setter(into, strip_option), default)]
574pub struct SetRoleRequest {
575    #[endpoint(skip)]
576    pub mount: String,
577    #[endpoint(skip)]
578    pub name: String,
579    pub issuer_ref: Option<String>,
580    pub allow_any_name: Option<bool>,
581    pub allow_bare_domains: Option<bool>,
582    pub allow_glob_domains: Option<bool>,
583    pub allow_ip_sans: Option<bool>,
584    pub allow_localhost: Option<bool>,
585    pub allow_subdomains: Option<bool>,
586    pub allow_token_displayname: Option<bool>,
587    pub allowed_domains: Option<Vec<String>>,
588    pub allowed_domains_template: Option<bool>,
589    pub allowed_other_sans: Option<Vec<String>>,
590    pub allowed_serial_numbers: Option<Vec<String>>,
591    pub allowed_uri_sans: Option<Vec<String>>,
592    pub basic_constraints_valid_for_non_ca: Option<bool>,
593    pub client_flag: Option<bool>,
594    pub code_signing_flag: Option<bool>,
595    pub country: Option<Vec<String>>,
596    pub email_protection_flag: Option<bool>,
597    pub enforce_hostnames: Option<bool>,
598    pub ext_key_usage: Option<Vec<String>>,
599    pub ext_key_usage_oids: Option<Vec<String>>,
600    pub generate_lease: Option<bool>,
601    pub key_bits: Option<u64>,
602    pub key_type: Option<String>,
603    pub key_usage: Option<Vec<String>>,
604    pub locality: Option<Vec<String>>,
605    pub max_ttl: Option<String>,
606    pub no_store: Option<bool>,
607    pub not_before_duration: Option<u64>,
608    pub organization: Option<Vec<String>>,
609    pub ou: Option<Vec<String>>,
610    pub policy_identifiers: Option<Vec<String>>,
611    pub postal_code: Option<Vec<String>>,
612    pub province: Option<Vec<String>>,
613    pub require_cn: Option<bool>,
614    pub server_flag: Option<bool>,
615    pub street_address: Option<Vec<String>>,
616    pub ttl: Option<String>,
617    pub use_csr_common_name: Option<bool>,
618    pub use_csr_sans: Option<bool>,
619}
620
621/// ## Delete Role
622/// This endpoint deletes the role definition. Deleting a role does not revoke
623/// certificates previously issued under this role.
624///
625/// * Path: {self.mount}/roles/{self.name}
626/// * Method: DELETE
627/// * Response: N/A
628/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#delete-role>
629#[derive(Builder, Debug, Default, Endpoint)]
630#[endpoint(
631    path = "{self.mount}/roles/{self.name}",
632    method = "DELETE",
633    builder = "true"
634)]
635#[builder(setter(into, strip_option), default)]
636pub struct DeleteRoleRequest {
637    #[endpoint(skip)]
638    pub mount: String,
639    #[endpoint(skip)]
640    pub name: String,
641}
642
643/// ## Tidy
644/// This endpoint allows tidying up the storage backend and/or CRL by removing
645/// certificates that have expired and are past a certain buffer period beyond
646/// their expiration time.
647///
648/// * Path: {self.mount}/tidy
649/// * Method: POST
650/// * Response: N/A
651/// * Reference: <https://developer.hashicorp.com/vault/api-docssecret/pki#tidy>
652#[derive(Builder, Debug, Default, Endpoint)]
653#[endpoint(
654    path = "{self.mount}/tidy",
655    method = "POST",
656    response = "()",
657    builder = "true"
658)]
659#[builder(setter(into, strip_option), default)]
660pub struct TidyRequest {
661    #[endpoint(skip)]
662    pub mount: String,
663    pub tidy_cert_store: Option<bool>,
664    pub tidy_revoked_certs: Option<bool>,
665    pub safety_buffer: Option<String>,
666}
667
668/// ## List issuer
669/// This endpoint returns a list of issuers currently provisioned in this mount.
670///
671/// * Path: {self.mount}/issuers
672/// * Method: LIST
673/// * Response: [ListIssuersResponse]
674/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#list-issuers
675#[derive(Builder, Debug, Default, Endpoint)]
676#[endpoint(
677    path = "{self.mount}/issuers",
678    method = "LIST",
679    response = "ListIssuersResponse",
680    builder = "true"
681)]
682#[builder(setter(into, strip_option), default)]
683pub struct ListIssuersRequest {
684    #[endpoint(skip)]
685    pub mount: String,
686}
687
688/// ## Read issuer certificate
689/// This endpoint retrieves the specified issuer's certificate and CA chain.
690///
691/// * Path: {self.mount}/issuer/{self.issuer}/json
692/// * Method: GET
693/// * Response: [ReadIssuerCertificateResponse]
694/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#read-issuer-certificate
695#[derive(Builder, Debug, Default, Endpoint)]
696#[endpoint(
697    path = "{self.mount}/issuer/{self.issuer}/json",
698    response = "ReadIssuerCertificateResponse",
699    builder = "true"
700)]
701#[builder(setter(into, strip_option), default)]
702pub struct ReadIssuerCertificateRequest {
703    #[endpoint(skip)]
704    pub mount: String,
705    #[endpoint(skip)]
706    pub issuer: String,
707}
708
709/// ## Sign Intermediate
710/// This endpoint uses the configured CA certificate to issue a certificate with
711/// appropriate values for acting as an intermediate CA.
712///
713/// * Path: {self.mount}/issuers/{self.issuer}/sign-intermediate
714/// * Method: POST
715/// * Response: [SignIntermediateIssuerResponse]
716/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#sign-intermediate
717#[derive(Builder, Debug, Default, Endpoint)]
718#[endpoint(
719    path = "{self.mount}/issuer/{self.issuer}/sign-intermediate",
720    method = "POST",
721    response = "SignIntermediateIssuerResponse",
722    builder = "true"
723)]
724#[builder(setter(into, strip_option), default)]
725pub struct SignIntermediateIssuerRequest {
726    #[endpoint(skip)]
727    pub mount: String,
728    pub alt_names: Option<String>,
729    pub csr: String,
730    pub common_name: String,
731    pub country: Option<Vec<String>>,
732    pub exclude_cn_from_sans: Option<bool>,
733    pub format: Option<String>,
734    pub ip_sans: Option<String>,
735    pub issuer: String,
736    pub locality: Option<Vec<String>>,
737    pub max_path_length: Option<i32>,
738    pub not_after: Option<String>,
739    pub not_before_duration: Option<u64>,
740    pub organization: Option<Vec<String>>,
741    pub other_sans: Option<Vec<String>>,
742    pub ou: Option<Vec<String>>,
743    pub postal_code: Option<Vec<String>>,
744    pub province: Option<Vec<String>>,
745    pub permitted_dns_domains: Vec<String>,
746    pub serial_number: Option<String>,
747    pub signature_bits: Option<u16>,
748    pub skid: Option<String>,
749    pub street_address: Option<Vec<String>>,
750    pub ttl: Option<String>,
751    pub uri_sans: Option<String>,
752    pub use_pss: Option<bool>,
753    pub use_csr_values: Option<bool>,
754}
755
756/// ## Import issuer
757/// This endpoint allows submitting the CA information for the backend via a PEM
758/// file containing the CA certificate and its private key, concatenated.
759///
760/// * Path: {self.mount}/issuers/import/bundle
761/// * Method: POST
762/// * Response: [ImportIssuerResponse]
763/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#import-ca-certificates-and-keys
764#[derive(Builder, Debug, Default, Endpoint)]
765#[endpoint(
766    path = "{self.mount}/issuers/import/bundle",
767    method = "POST",
768    response = "ImportIssuerResponse",
769    builder = "true"
770)]
771#[builder(setter(into, strip_option), default)]
772pub struct ImportIssuerRequest {
773    #[endpoint(skip)]
774    pub mount: String,
775    pub pem_bundle: String,
776}
777
778/// ## Set default issuer
779/// This endpoint allows setting the value of the default issuer.
780///
781/// * Path: {self.mount}/config/issuers
782/// * Method: POST
783/// * Response: "SetDefaultIssuerResponse"
784/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#set-issuers-configuration
785#[derive(Builder, Debug, Default, Endpoint, Serialize)]
786#[endpoint(
787    path = "{self.mount}/config/issuers",
788    method = "POST",
789    response = "SetDefaultIssuerResponse",
790    builder = "false"
791)]
792#[builder(setter(into, strip_option), default)]
793pub struct SetDefaultIssuerRequest {
794    #[endpoint(skip)]
795    pub mount: String,
796    #[serde(rename = "default")]
797    pub default_issuer: String,
798}
799
800/// ## Update issuer
801/// This endpoint allows an operator to manage a single issuer, updating various properties about it,
802/// including its name, an explicitly constructed chain, what the behavior is for signing longer TTL'd certificates,
803/// and what usage modes are set on this issuer.
804///
805/// * Path: {self.mount}/issuer/{self.issuer_ref}
806/// * Method: POST
807/// * Response: "UpdateIssuerResponse"
808/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#update-issuer
809#[derive(Builder, Debug, Default, Endpoint, Serialize)]
810#[endpoint(
811    path = "{self.mount}/issuer/{self.issuer_ref}",
812    method = "POST",
813    response = "UpdateIssuerResponse",
814    builder = "true"
815)]
816#[builder(setter(into, strip_option), default)]
817pub struct UpdateIssuerRequest {
818    #[endpoint(skip)]
819    pub mount: String,
820    #[endpoint(skip)]
821    pub issuer_ref: String,
822    pub issuer_name: Option<String>,
823    pub leaf_not_after_behavior: Option<String>,
824    pub manual_chain: Option<Vec<String>>,
825    pub usage: Option<Vec<String>>,
826    pub revocation_signature_algorithm: Option<String>,
827    pub issuing_certificates: Option<Vec<String>>,
828    pub crl_distribution_points: Option<Vec<String>>,
829    pub delta_crl_distribution_points: Option<Vec<String>>,
830    pub ocsp_servers: Option<Vec<String>>,
831    pub enable_aia_url_templating: Option<bool>,
832    pub disable_critical_extension_checks: Option<bool>,
833    pub disable_path_length_checks: Option<bool>,
834    pub disable_name_checks: Option<bool>,
835    pub disable_name_constraint_checks: Option<bool>,
836}
837
838/// ## Delete issuer
839/// This endpoint deletes the issuer.
840///
841/// * Path: {self.mount}/issuer/{self.issuer}
842/// * Method: DELETE
843/// * Response: N/A
844/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#delete-issuer
845#[derive(Builder, Debug, Default, Endpoint)]
846#[endpoint(
847    path = "{self.mount}/issuer/{self.issuer}",
848    method = "DELETE",
849    builder = "true"
850)]
851#[builder(setter(into, strip_option), default)]
852pub struct DeleteIssuerRequest {
853    #[endpoint(skip)]
854    pub mount: String,
855    #[endpoint(skip)]
856    pub issuer: String,
857}
858
859/// ## Generate intermediate CSR
860/// This endpoint returns a new CSR for signing, optionally generating a new private key.
861///
862/// * Path: {self.mount}/issuers/generate/intermediate/{self.request_type}
863/// * Method: POST
864/// * Response: [GenerateIntermediateCSRResponse]
865/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#generate-intermediate-csr
866#[derive(Builder, Debug, Default, Endpoint, Serialize)]
867#[endpoint(
868    path = "{self.mount}/issuers/generate/intermediate/{self.request_type}",
869    method = "POST",
870    response = "GenerateIntermediateCSRResponse",
871    builder = "true"
872)]
873#[builder(setter(into, strip_option), default)]
874pub struct GenerateIntermediateCSRRequest {
875    #[endpoint(skip)]
876    pub mount: String,
877    #[endpoint(skip)]
878    #[serde(rename = "type")]
879    pub request_type: String,
880    pub add_basic_constraints: Option<bool>,
881    pub alt_names: Option<String>,
882    pub common_name: Option<String>,
883    pub country: Option<Vec<String>>,
884    pub exclude_cn_from_sans: Option<bool>,
885    pub format: Option<String>,
886    pub ip_sans: Option<String>,
887    pub key_bits: Option<u64>,
888    pub key_name: Option<String>,
889    pub key_ref: Option<String>,
890    pub key_type: Option<String>,
891    pub locality: Option<Vec<String>>,
892    pub organization: Option<Vec<String>>,
893    pub other_sans: Option<Vec<String>>,
894    pub ou: Option<Vec<String>>,
895    pub postal_code: Option<Vec<String>>,
896    pub private_key_format: Option<String>,
897    pub province: Option<Vec<String>>,
898    pub serial_number: Option<String>,
899    pub signature_bits: u16,
900    pub street_address: Option<Vec<String>>,
901    pub uri_sans: Option<String>,
902}
903
904/// ## Delete key
905/// This endpoint deletes the key.
906///
907/// * Path: {self.mount}/key/{self.key}
908/// * Method: DELETE
909/// * Response: N/A
910/// * Reference: https://developer.hashicorp.com/vault/api-docs/secret/pki#delete-key
911#[derive(Builder, Debug, Default, Endpoint)]
912#[endpoint(
913    path = "{self.mount}/key/{self.key}",
914    method = "DELETE",
915    builder = "true"
916)]
917#[builder(setter(into, strip_option), default)]
918pub struct DeleteKeyRequest {
919    #[endpoint(skip)]
920    pub mount: String,
921    #[endpoint(skip)]
922    pub key: String,
923}
vaultrs/api/pki/requests.rs

vaultrs/api/pki/
requests.rs
