{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/azure-networking-services/json-schema/azure-networking-services-authentication-policy-list-result-schema.json",
  "title": "AuthenticationPolicyListResult",
  "description": "The response of a AuthenticationPolicy list operation.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/azure-networking-services-authenticationpolicies-api-openapi.yml#/components/schemas/AuthenticationPolicyListResult",
  "type": "object",
  "properties": {
    "value": {
      "type": "array",
      "description": "The AuthenticationPolicy items on this page",
      "items": {
        "$ref": "#/$defs/AuthenticationPolicy"
      }
    },
    "nextLink": {
      "type": "string",
      "format": "uri",
      "description": "The link to the next page of items"
    }
  },
  "required": [
    "value"
  ],
  "$defs": {
    "AuthenticationPolicy": {
      "type": "object",
      "description": "Authentication policy resource for identity integration.",
      "properties": {
        "properties": {
          "$ref": "#/$defs/AuthenticationPolicyPropertiesFormat",
          "description": "Properties of the authentication policy."
        },
        "etag": {
          "type": "string",
          "description": "A unique read-only string that changes whenever the resource is updated.",
          "readOnly": true
        },
        "identity": {
          "$ref": "#/$defs/ManagedServiceIdentity",
          "description": "The user-assigned identity used by a user sign-in policy to access its Key Vault client secret."
        },
        "systemData": {
          "$ref": "#/$defs/systemData",
          "description": "The system metadata related to this resource.",
          "readOnly": true
        }
      },
      "allOf": [
        {
          "$ref": "#/$defs/Resource"
        }
      ]
    },
    "AuthenticationPolicyPropertiesFormat": {
      "type": "object",
      "description": "Properties of the authentication policy.",
      "properties": {
        "userTrustProviderType": {
          "$ref": "#/$defs/UserTrustProviderType",
          "description": "The type of the user trust provider. Only Microsoft Entra is supported, using the serialized value `entra`."
        },
        "onUnauthenticatedRequest": {
          "$ref": "#/$defs/OnUnauthenticatedRequest",
          "description": "The action to take when a request is unauthenticated. When omitted, user sign-in policies default to `authenticate` and JWT validation policies default to `deny`."
        },
        "authenticationProperties": {
          "$ref": "#/$defs/AuthenticationProviderProperties",
          "description": "The authentication provider configuration for the policy."
        },
        "associatedResources": {
          "type": "array",
          "description": "A collection of resource IDs that reference this authentication policy.",
          "items": {
            "type": "string"
          },
          "readOnly": true
        },
        "provisioningState": {
          "$ref": "#/$defs/ProvisioningState",
          "description": "The provisioning state of the authentication policy resource.",
          "readOnly": true
        },
        "resourceGuid": {
          "type": "string",
          "description": "The resource GUID property of the authentication policy resource.",
          "readOnly": true
        }
      },
      "required": [
        "userTrustProviderType",
        "authenticationProperties"
      ]
    },
    "AuthenticationProviderProperties": {
      "type": "object",
      "description": "Properties for authentication provider configuration. A policy must configure either JWT validation fields or user sign-in fields; the two configurations are mutually exclusive and cannot be combined.",
      "properties": {
        "issuer": {
          "type": "string",
          "format": "uri",
          "description": "The absolute HTTPS URL of the Secure Token Service. Include a trailing slash at the end of the value. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/",
          "maxLength": 2048,
          "pattern": "^[Hh][Tt][Tt][Pp][Ss]://"
        },
        "jwksUri": {
          "type": "string",
          "format": "uri",
          "description": "The JSON Web Key Set (JWKS) URI used to retrieve the public keys for JWT validation. Example: https://login.microsoftonline.com/{Microsoft Entra Tenant ID}/discovery/v2.0/keys",
          "maxLength": 2048,
          "pattern": "^[Hh][Tt][Tt][Pp][Ss]://"
        },
        "audience": {
          "type": "string",
          "description": "The intended audience for the JWT. Only a single audience value is supported in this API version. Example: https://audience.com/{application-id}",
          "maxLength": 2048
        },
        "clientId": {
          "type": "string",
          "description": "The Application (client) ID for the related application registered in Microsoft Entra ID, formatted as a GUID.",
          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
        },
        "clientSecret": {
          "type": "string",
          "format": "uri",
          "description": "The absolute HTTPS Key Vault secret URL identifying the client secret used for authentication. This property is required for user sign-in policies. It holds only the Key Vault reference; the secret value itself is never accepted or returned by this API and is read from Key Vault at runtime using the resource's user-assigned identity. The secret value stored in Key Vault can contain up to 4096 characters. Example: https://myvault.vault.azure.net/secrets/mysecret",
          "pattern": "^[Hh][Tt][Tt][Pp][Ss]://"
        },
        "scope": {
          "type": "array",
          "description": "The scopes used by an application during authentication to authorize access to a user's details. A maximum of 10 scopes is supported, each scope can contain up to 128 characters, and all scopes can contain up to 256 characters combined.",
          "maxItems": 10,
          "items": {
            "$ref": "#/$defs/AuthenticationScope"
          }
        },
        "sessionTimeout": {
          "type": "string",
          "description": "The timeout of the session cookie used for user authentication. The service accepts and returns this value as a string containing a base-10 unsigned integer number of seconds with no sign, decimal point, unit suffix, or whitespace (for example `86400`). The supported range is 1 to 604800 seconds, and the default is 86400 seconds. Applicable to the Application Gateway post-OIDC workflow.",
          "maxLength": 6,
          "pattern": "^[1-9][0-9]{0,5}$"
        },
        "sessionCookieName": {
          "type": "string",
          "description": "The name of the session cookie used for user authentication. Applicable to the Application Gateway post-OIDC workflow.",
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9_-]+$"
        }
      },
      "required": [
        "issuer",
        "clientId"
      ]
    },
    "AuthenticationScope": {
      "type": "string",
      "description": "An authentication scope value.",
      "minLength": 1,
      "maxLength": 128,
      "pattern": "^[A-Za-z0-9_.:/-]+$"
    },
    "ManagedServiceIdentity": {
      "type": "object",
      "description": "Identity for the resource.",
      "properties": {
        "principalId": {
          "type": "string",
          "description": "The principal id of the system assigned identity. This property will only be provided for a system assigned identity.",
          "readOnly": true
        },
        "tenantId": {
          "type": "string",
          "description": "The tenant id of the system assigned identity. This property will only be provided for a system assigned identity.",
          "readOnly": true
        },
        "type": {
          "$ref": "#/$defs/ResourceIdentityType",
          "description": "The type of identity used for the resource. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user assigned identities. The type 'None' will remove any identities from the virtual machine."
        },
        "userAssignedIdentities": {
          "type": "object",
          "description": "The list of user identities associated with resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.",
          "additionalProperties": {
            "$ref": "#/$defs/ManagedServiceIdentityUserAssignedIdentities"
          }
        }
      }
    },
    "OnUnauthenticatedRequest": {
      "type": "string",
      "description": "Action to take when a request is unauthenticated.",
      "enum": [
        "allow",
        "authenticate",
        "deny"
      ],
      "x-ms-enum": {
        "name": "OnUnauthenticatedRequest",
        "modelAsString": true,
        "values": [
          {
            "name": "Allow",
            "value": "allow",
            "description": "Allow the request to pass through without authentication."
          },
          {
            "name": "Authenticate",
            "value": "authenticate",
            "description": "Redirect the request to the authentication provider. Only valid for the user authentication capability."
          },
          {
            "name": "Deny",
            "value": "deny",
            "description": "Deny the request when no credential is presented."
          }
        ]
      }
    },
    "ProvisioningState": {
      "type": "string",
      "description": "Provisioning states of a resource.",
      "enum": [
        "Failed",
        "Succeeded",
        "Canceled",
        "Creating",
        "Updating",
        "Deleting"
      ],
      "x-ms-enum": {
        "name": "ProvisioningState",
        "modelAsString": true,
        "values": [
          {
            "name": "Failed",
            "value": "Failed",
            "description": "Failed"
          },
          {
            "name": "Succeeded",
            "value": "Succeeded",
            "description": "Succeeded"
          },
          {
            "name": "Canceled",
            "value": "Canceled",
            "description": "Canceled"
          },
          {
            "name": "Creating",
            "value": "Creating",
            "description": "Creating"
          },
          {
            "name": "Updating",
            "value": "Updating",
            "description": "Updating"
          },
          {
            "name": "Deleting",
            "value": "Deleting",
            "description": "Deleting"
          }
        ]
      }
    },
    "Resource": {
      "type": "object",
      "description": "Common resource representation.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Resource ID."
        },
        "name": {
          "type": "string",
          "description": "Resource name.",
          "readOnly": true
        },
        "type": {
          "type": "string",
          "description": "Resource type.",
          "readOnly": true
        },
        "location": {
          "type": "string",
          "description": "Resource location."
        },
        "tags": {
          "type": "object",
          "description": "Resource tags.",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "x-ms-azure-resource": true
    },
    "UserTrustProviderType": {
      "type": "string",
      "description": "Type of the user trust provider.",
      "enum": [
        "entra"
      ],
      "x-ms-enum": {
        "name": "UserTrustProviderType",
        "modelAsString": true,
        "values": [
          {
            "name": "Entra",
            "value": "entra",
            "description": "Microsoft Entra trust provider type."
          }
        ]
      }
    },
    "systemData": {
      "type": "object",
      "description": "Metadata pertaining to creation and last modification of the resource.",
      "properties": {
        "createdBy": {
          "type": "string",
          "description": "The identity that created the resource."
        },
        "createdByType": {
          "type": "string",
          "description": "The type of identity that created the resource.",
          "enum": [
            "User",
            "Application",
            "ManagedIdentity",
            "Key"
          ],
          "x-ms-enum": {
            "name": "createdByType",
            "modelAsString": true
          }
        },
        "createdAt": {
          "type": "string",
          "format": "date-time",
          "description": "The timestamp of resource creation (UTC)."
        },
        "lastModifiedBy": {
          "type": "string",
          "description": "The identity that last modified the resource."
        },
        "lastModifiedByType": {
          "type": "string",
          "description": "The type of identity that last modified the resource.",
          "enum": [
            "User",
            "Application",
            "ManagedIdentity",
            "Key"
          ],
          "x-ms-enum": {
            "name": "createdByType",
            "modelAsString": true
          }
        },
        "lastModifiedAt": {
          "type": "string",
          "format": "date-time",
          "description": "The timestamp of resource last modification (UTC)"
        }
      },
      "readOnly": true
    }
  }
}