{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/amazon-private-ca/json-schema/amazon-private-ca-list-template-group-access-control-entries-response-schema.json",
  "title": "ListTemplateGroupAccessControlEntriesResponse",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/amazon-private-ca-accesscontrolentries-api-openapi.yml#/components/schemas/ListTemplateGroupAccessControlEntriesResponse",
  "type": "object",
  "properties": {
    "AccessControlEntries": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/AccessControlEntrySummary"
      },
      "description": "An access control entry grants or denies permission to an Active Directory group to enroll certificates for a template."
    },
    "NextToken": {
      "type": "string",
      "description": "Use this parameter when paginating results in a subsequent request after you receive a response with truncated results. Set it to the value of the NextToken parameter from the response you just received."
    }
  },
  "$defs": {
    "AccessControlEntrySummary": {
      "type": "object",
      "properties": {
        "GroupDisplayName": {
          "type": "string",
          "description": "Name of the Active Directory group. This name does not need to match the group name in Active Directory."
        },
        "GroupSecurityIdentifier": {
          "type": "string",
          "description": "Security identifier (SID) of the group object from Active Directory. The SID starts with \"S-\"."
        },
        "AccessRights": {
          "$ref": "#/$defs/AccessRights"
        },
        "TemplateArn": {
          "type": "string",
          "description": "The Amazon Resource Name (ARN) that was returned when you called CreateTemplate."
        },
        "CreatedAt": {
          "type": "string",
          "description": "The date and time that the Access Control Entry was created."
        },
        "UpdatedAt": {
          "type": "string",
          "description": "The date and time that the Access Control Entry was updated."
        }
      }
    },
    "AccessRights": {
      "type": "object",
      "properties": {
        "Enroll": {
          "type": "string",
          "enum": [
            "ALLOW",
            "DENY"
          ],
          "description": "Allow or deny an Active Directory group from enrolling certificates issued against a template."
        },
        "AutoEnroll": {
          "type": "string",
          "enum": [
            "ALLOW",
            "DENY"
          ],
          "description": "Allow or deny an Active Directory group from autoenrolling certificates issued against a template. The Active Directory group must be allowed to enroll to allow autoenrollment"
        }
      }
    }
  }
}