{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-azure-cdn/json-schema/microsoft-azure-cdn-afddomain-schema.json",
  "title": "AFDDomain",
  "description": "Friendly domain name mapping to the endpoint hostname that the customer provides for branding purposes, e.g. www.contoso.com.",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_superseded/microsoft-azure-cdn-afddomains-api-openapi.yml#/components/schemas/AFDDomain",
  "type": "object",
  "properties": {
    "properties": {
      "$ref": "#/$defs/AFDDomainProperties",
      "description": "The JSON object that contains the properties of the domain to create.",
      "x-ms-client-flatten": true
    }
  },
  "allOf": [
    {
      "$ref": "../../../../../../common-types/resource-management/v6/types.json#/definitions/ProxyResource"
    }
  ],
  "$defs": {
    "AFDDomainHttpsCustomizedCipherSuiteSet": {
      "type": "object",
      "description": "Customized cipher suite set object that will be used for Https when cipherSuiteSetType is Customized.",
      "properties": {
        "cipherSuiteSetForTls12": {
          "type": "array",
          "description": "Cipher suites for TLS 1.2. Required at least one in minimumTlsVersion TLS 1.2.",
          "items": {
            "$ref": "#/$defs/AfdCustomizedCipherSuiteForTls12"
          }
        },
        "cipherSuiteSetForTls13": {
          "type": "array",
          "description": "Cipher suites for TLS 1.3. Required at least one in minimumTlsVersion TLS 1.2, TLS 1.3.",
          "items": {
            "$ref": "#/$defs/AfdCustomizedCipherSuiteForTls13"
          }
        }
      }
    },
    "AFDDomainHttpsParameters": {
      "type": "object",
      "description": "The JSON object that contains the properties to secure a domain.",
      "properties": {
        "certificateType": {
          "$ref": "#/$defs/AfdCertificateType",
          "description": "Defines the source of the SSL certificate."
        },
        "cipherSuiteSetType": {
          "$ref": "#/$defs/AfdCipherSuiteSetType",
          "description": "cipher suite set type that will be used for Https"
        },
        "minimumTlsVersion": {
          "$ref": "#/$defs/AfdMinimumTlsVersion",
          "description": "TLS protocol version that will be used for Https when cipherSuiteSetType is Customized."
        },
        "customizedCipherSuiteSet": {
          "$ref": "#/$defs/AFDDomainHttpsCustomizedCipherSuiteSet",
          "description": "Customized cipher suites object that will be used for Https when cipherSuiteSetType is Customized."
        },
        "serverTlsGroupPolicy": {
          "$ref": "#/$defs/AfdServerTlsGroupPolicy",
          "description": "Server TLS group policy that will be used for Https."
        },
        "serverTlsGroups": {
          "type": "array",
          "description": "Server TLS groups that will be used for Https when serverTlsGroupPolicy is Custom.",
          "items": {
            "$ref": "#/$defs/AfdServerTlsGroup"
          }
        },
        "secret": {
          "$ref": "#/$defs/ResourceReference",
          "description": "Resource reference to the secret. ie. subs/rg/profile/secret"
        }
      },
      "required": [
        "certificateType"
      ]
    },
    "AFDDomainMtlsParameters": {
      "type": "object",
      "description": "Contains the properties to configure mutual TLS for a custom domain with FQDN. Mutual TLS cannot be configured for custom domains with wildcard host names.",
      "properties": {
        "scenario": {
          "$ref": "#/$defs/MtlsScenarioType",
          "description": "Supported scenarios for establishing mTLS connection."
        }
      },
      "required": [
        "scenario"
      ]
    },
    "AFDDomainProperties": {
      "type": "object",
      "description": "The JSON object that contains the properties of the domain to create.",
      "properties": {
        "profileName": {
          "type": "string",
          "description": "The name of the profile which holds the domain.",
          "readOnly": true
        },
        "tlsSettings": {
          "$ref": "#/$defs/AFDDomainHttpsParameters",
          "description": "The configuration specifying how to enable HTTPS for the domain - using AzureFrontDoor managed certificate or user's own certificate. If not specified, enabling ssl uses AzureFrontDoor managed certificate by default."
        },
        "mtlsSettings": {
          "$ref": "#/$defs/AFDDomainMtlsParameters",
          "description": "The configuration specifying how to enable mutual TLS for the domain, including specifying allowed FQDNs and which server certificate(s) to use."
        },
        "azureDnsZone": {
          "$ref": "#/$defs/ResourceReference",
          "description": "Resource reference to the Azure DNS zone"
        },
        "preValidatedCustomDomainResourceId": {
          "$ref": "#/$defs/ResourceReference",
          "description": "Resource reference to the Azure resource where custom domain ownership was prevalidated"
        },
        "provisioningState": {
          "$ref": "#/$defs/AfdProvisioningState",
          "description": "Provisioning status",
          "readOnly": true
        },
        "deploymentStatus": {
          "$ref": "#/$defs/DeploymentStatus",
          "readOnly": true
        },
        "domainValidationState": {
          "$ref": "#/$defs/DomainValidationState",
          "description": "Provisioning substate shows the progress of custom HTTPS enabling/disabling process step by step. DCV stands for DomainControlValidation.",
          "readOnly": true
        },
        "hostName": {
          "type": "string",
          "description": "The host name of the domain. Must be a domain name."
        },
        "extendedProperties": {
          "type": "object",
          "description": "Key-Value pair representing migration properties for domains.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "validationProperties": {
          "$ref": "#/$defs/DomainValidationProperties",
          "description": "Values the customer needs to validate domain ownership",
          "readOnly": true
        }
      },
      "required": [
        "hostName"
      ]
    },
    "AfdCertificateType": {
      "type": "string",
      "description": "Defines the source of the SSL certificate.",
      "enum": [
        "CustomerCertificate",
        "ManagedCertificate",
        "AzureFirstPartyManagedCertificate"
      ],
      "x-ms-enum": {
        "name": "AfdCertificateType",
        "modelAsString": true,
        "values": [
          {
            "name": "CustomerCertificate",
            "value": "CustomerCertificate"
          },
          {
            "name": "ManagedCertificate",
            "value": "ManagedCertificate"
          },
          {
            "name": "AzureFirstPartyManagedCertificate",
            "value": "AzureFirstPartyManagedCertificate"
          }
        ]
      }
    },
    "AfdCipherSuiteSetType": {
      "type": "string",
      "description": "cipher suite set type that will be used for Https",
      "enum": [
        "Customized",
        "TLS10_2019",
        "TLS12_2022",
        "TLS12_2023"
      ],
      "x-ms-enum": {
        "name": "AfdCipherSuiteSetType",
        "modelAsString": true,
        "values": [
          {
            "name": "Customized",
            "value": "Customized"
          },
          {
            "name": "TLS10_2019",
            "value": "TLS10_2019"
          },
          {
            "name": "TLS12_2022",
            "value": "TLS12_2022"
          },
          {
            "name": "TLS12_2023",
            "value": "TLS12_2023"
          }
        ]
      }
    },
    "AfdCustomizedCipherSuiteForTls12": {
      "type": "string",
      "enum": [
        "ECDHE_RSA_AES128_GCM_SHA256",
        "ECDHE_RSA_AES256_GCM_SHA384",
        "DHE_RSA_AES256_GCM_SHA384",
        "DHE_RSA_AES128_GCM_SHA256",
        "ECDHE_RSA_AES128_SHA256",
        "ECDHE_RSA_AES256_SHA384"
      ],
      "x-ms-enum": {
        "name": "AfdCustomizedCipherSuiteForTls12",
        "modelAsString": true,
        "values": [
          {
            "name": "ECDHE_RSA_AES128_GCM_SHA256",
            "value": "ECDHE_RSA_AES128_GCM_SHA256"
          },
          {
            "name": "ECDHE_RSA_AES256_GCM_SHA384",
            "value": "ECDHE_RSA_AES256_GCM_SHA384"
          },
          {
            "name": "DHE_RSA_AES256_GCM_SHA384",
            "value": "DHE_RSA_AES256_GCM_SHA384"
          },
          {
            "name": "DHE_RSA_AES128_GCM_SHA256",
            "value": "DHE_RSA_AES128_GCM_SHA256"
          },
          {
            "name": "ECDHE_RSA_AES128_SHA256",
            "value": "ECDHE_RSA_AES128_SHA256"
          },
          {
            "name": "ECDHE_RSA_AES256_SHA384",
            "value": "ECDHE_RSA_AES256_SHA384"
          }
        ]
      }
    },
    "AfdCustomizedCipherSuiteForTls13": {
      "type": "string",
      "enum": [
        "TLS_AES_128_GCM_SHA256",
        "TLS_AES_256_GCM_SHA384"
      ],
      "x-ms-enum": {
        "name": "AfdCustomizedCipherSuiteForTls13",
        "modelAsString": true,
        "values": [
          {
            "name": "TLS_AES_128_GCM_SHA256",
            "value": "TLS_AES_128_GCM_SHA256"
          },
          {
            "name": "TLS_AES_256_GCM_SHA384",
            "value": "TLS_AES_256_GCM_SHA384"
          }
        ]
      }
    },
    "AfdMinimumTlsVersion": {
      "type": "string",
      "description": "TLS protocol version that will be used for Https when cipherSuiteSetType is Customized.",
      "enum": [
        "TLS10",
        "TLS12",
        "TLS13"
      ],
      "x-ms-enum": {
        "name": "AfdMinimumTlsVersion",
        "modelAsString": false
      }
    },
    "AfdProvisioningState": {
      "type": "string",
      "description": "Provisioning status",
      "enum": [
        "Succeeded",
        "Failed",
        "Updating",
        "Deleting",
        "Creating"
      ],
      "x-ms-enum": {
        "name": "AfdProvisioningState",
        "modelAsString": true,
        "values": [
          {
            "name": "Succeeded",
            "value": "Succeeded"
          },
          {
            "name": "Failed",
            "value": "Failed"
          },
          {
            "name": "Updating",
            "value": "Updating"
          },
          {
            "name": "Deleting",
            "value": "Deleting"
          },
          {
            "name": "Creating",
            "value": "Creating"
          }
        ]
      }
    },
    "AfdServerTlsGroup": {
      "type": "string",
      "description": "Supported key-exchange groups and curves. The ML-KEM groups are hybrid post-quantum groups.",
      "enum": [
        "SecP256r1MLKEM768",
        "SecP384r1MLKEM1024",
        "X25519MLKEM768",
        "prime256v1",
        "X25519",
        "secp384r1",
        "secp521r1"
      ],
      "x-ms-enum": {
        "name": "AfdServerTlsGroup",
        "modelAsString": true,
        "values": [
          {
            "name": "SecP256r1MLKEM768",
            "value": "SecP256r1MLKEM768",
            "description": "Hybrid post-quantum group combining secp256r1 with ML-KEM-768."
          },
          {
            "name": "SecP384r1MLKEM1024",
            "value": "SecP384r1MLKEM1024",
            "description": "Hybrid post-quantum group combining secp384r1 with ML-KEM-1024."
          },
          {
            "name": "X25519MLKEM768",
            "value": "X25519MLKEM768",
            "description": "Hybrid post-quantum group combining X25519 with ML-KEM-768."
          },
          {
            "name": "prime256v1",
            "value": "prime256v1",
            "description": "The prime256v1 elliptic curve group."
          },
          {
            "name": "X25519",
            "value": "X25519",
            "description": "The X25519 elliptic curve group."
          },
          {
            "name": "secp384r1",
            "value": "secp384r1",
            "description": "The secp384r1 elliptic curve group."
          },
          {
            "name": "secp521r1",
            "value": "secp521r1",
            "description": "The secp521r1 elliptic curve group."
          }
        ]
      }
    },
    "AfdServerTlsGroupPolicy": {
      "type": "string",
      "description": "Server TLS group policy that will be used for Https. Standard and Enhanced are service-managed sets; Custom allows specifying serverTlsGroups explicitly.",
      "enum": [
        "Standard",
        "Enhanced",
        "Custom"
      ],
      "x-ms-enum": {
        "name": "AfdServerTlsGroupPolicy",
        "modelAsString": true,
        "values": [
          {
            "name": "Standard",
            "value": "Standard",
            "description": "Uses the standard service-managed set of server TLS groups."
          },
          {
            "name": "Enhanced",
            "value": "Enhanced",
            "description": "Uses the enhanced service-managed set of server TLS groups."
          },
          {
            "name": "Custom",
            "value": "Custom",
            "description": "Uses the server TLS groups specified by serverTlsGroups."
          }
        ]
      }
    },
    "DeploymentStatus": {
      "type": "string",
      "enum": [
        "NotStarted",
        "InProgress",
        "Succeeded",
        "Failed"
      ],
      "x-ms-enum": {
        "name": "DeploymentStatus",
        "modelAsString": true,
        "values": [
          {
            "name": "NotStarted",
            "value": "NotStarted"
          },
          {
            "name": "InProgress",
            "value": "InProgress"
          },
          {
            "name": "Succeeded",
            "value": "Succeeded"
          },
          {
            "name": "Failed",
            "value": "Failed"
          }
        ]
      }
    },
    "DomainValidationProperties": {
      "type": "object",
      "description": "The JSON object that contains the properties to validate a domain.",
      "properties": {
        "validationToken": {
          "type": "string",
          "description": "Challenge used for DNS TXT record or file based validation",
          "readOnly": true
        },
        "expirationDate": {
          "type": "string",
          "description": "The date time that the token expires",
          "readOnly": true
        }
      }
    },
    "DomainValidationState": {
      "type": "string",
      "description": "Provisioning substate shows the progress of custom HTTPS enabling/disabling process step by step. DCV stands for DomainControlValidation.",
      "enum": [
        "Unknown",
        "Submitting",
        "Pending",
        "Rejected",
        "TimedOut",
        "PendingRevalidation",
        "Approved",
        "RefreshingValidationToken",
        "InternalError"
      ],
      "x-ms-enum": {
        "name": "DomainValidationState",
        "modelAsString": true,
        "values": [
          {
            "name": "Unknown",
            "value": "Unknown"
          },
          {
            "name": "Submitting",
            "value": "Submitting"
          },
          {
            "name": "Pending",
            "value": "Pending"
          },
          {
            "name": "Rejected",
            "value": "Rejected"
          },
          {
            "name": "TimedOut",
            "value": "TimedOut"
          },
          {
            "name": "PendingRevalidation",
            "value": "PendingRevalidation"
          },
          {
            "name": "Approved",
            "value": "Approved"
          },
          {
            "name": "RefreshingValidationToken",
            "value": "RefreshingValidationToken"
          },
          {
            "name": "InternalError",
            "value": "InternalError"
          }
        ]
      }
    },
    "MtlsScenarioType": {
      "type": "string",
      "description": "Supported scenarios for establishing mTLS connection.",
      "enum": [
        "ClientCertificateRequiredAndValidated",
        "ClientCertificateRequiredAndOriginValidates",
        "ClientCertificateValidatedIfPresented",
        "CompleteMtlsPassthroughToOrigin"
      ],
      "x-ms-enum": {
        "name": "MtlsScenarioType",
        "modelAsString": true,
        "values": [
          {
            "name": "ClientCertificateRequiredAndValidated",
            "value": "ClientCertificateRequiredAndValidated"
          },
          {
            "name": "ClientCertificateRequiredAndOriginValidates",
            "value": "ClientCertificateRequiredAndOriginValidates"
          },
          {
            "name": "ClientCertificateValidatedIfPresented",
            "value": "ClientCertificateValidatedIfPresented"
          },
          {
            "name": "CompleteMtlsPassthroughToOrigin",
            "value": "CompleteMtlsPassthroughToOrigin"
          }
        ]
      }
    },
    "ResourceReference": {
      "type": "object",
      "description": "Reference to another resource.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Resource ID."
        }
      }
    }
  }
}