{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/oracle/json-schema/oracle-create-certificate-authority-details-schema.json",
  "title": "CreateCertificateAuthorityDetails",
  "description": "The details for creating a certificate authority (CA).",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/oracle-certificatesmanagement-api-openapi.yml#/components/schemas/CreateCertificateAuthorityDetails",
  "properties": {
    "certificateAuthorityConfig": {
      "$ref": "#/$defs/CreateCertificateAuthorityConfigDetails"
    },
    "certificateAuthorityRules": {
      "default": null,
      "description": "A list of rules that control how the CA is used and managed.",
      "items": {
        "$ref": "#/$defs/CertificateAuthorityRule"
      },
      "type": "array"
    },
    "certificateRevocationListDetails": {
      "$ref": "#/$defs/CertificateRevocationListDetails"
    },
    "compartmentId": {
      "description": "The compartment in which you want to create the CA.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "definedTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and Boolean types are supported.\n",
          "type": "object"
        },
        "description": "Key-value pair representing predefined tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "default": null,
      "description": "Usage of predefined tag keys. These predefined keys are scoped to namespaces.\nExample: `{\"foo-namespace\": {\"bar-key\": \"value\"}}`\n",
      "type": "object"
    },
    "description": {
      "default": null,
      "description": "A brief description of the CA.",
      "maxLength": 400,
      "minLength": 1,
      "type": "string"
    },
    "externalKeyDescription": {
      "description": "For externally managed CAs, a description of the externally managed private key. Avoid entering confidential information.",
      "maxLength": 400,
      "minLength": 1,
      "type": "string"
    },
    "freeformTags": {
      "additionalProperties": {
        "type": "string"
      },
      "default": null,
      "description": "Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.\nExample: `{\"bar-key\": \"value\"}`\n",
      "type": "object"
    },
    "kmsKeyId": {
      "description": "The OCID of the Oracle Cloud Infrastructure Vault key used to encrypt the CA.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "name": {
      "description": "A user-friendly name for the CA. Names are unique within a compartment. Avoid entering confidential information. Valid characters include uppercase or lowercase letters, numbers, hyphens, underscores, and periods.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    }
  },
  "required": [
    "name",
    "compartmentId",
    "certificateAuthorityConfig"
  ],
  "type": "object",
  "x-example": "{\n   \"certificateAuthorityConfig\": {\n      \"configType\": \"ROOT_CA_GENERATED_INTERNALLY\",\n      \"signingAlgorithm\": \"SHA512_WITH_RSA\",\n      \"subject\": {\n         \"commonName\": \"www.example.com\"\n      },\n      \"validity\": {\n         \"timeOfValidityNotAfter\": \"2031-05-06T00:00:00.000Z\"\n      }\n   },\n   \"certificateAuthorityRules\": [\n      {\n         \"advanceRenewalPeriod\": \"P30D\",\n         \"renewalInterval\": \"P3650D\",\n         \"ruleType\": \"CERTIFICATE_AUTHORITY_RENEWAL_RULE\"\n      }\n      {\n         \"ruleType\": \"CERTIFICATE_AUTHORITY_ISSUANCE_RULE\",\n         \"pathLengthConstraint\": 3,\n         \"nameConstraint\": {\n           \"permittedSubtree\": [\n             {\n               \"type\": \"DNS\",\n               \"value\": \"example.com\"\n             }\n           ],\n           \"excludedSubtree\": [\n             {\n               \"type\": \"DNS\",\n               \"value\": \"example.org\"\n            }\n           ]\n         }\n      }\n   ],\n   \"certificateRevocationListDetails\": {\n      \"objectStorageConfig\": {\n         \"objectStorageBucketName\": \"ca-crl-bucket\",\n         \"objectStorageNamespace\": \"example-namespace\",\n         \"objectStorageObjectNameFormat\": \"ca-1-crl\"\n      }\n   },\n   \"compartmentId\": \"ocid1.tenancy.oc1..exampleauingds4uwkcvbxv4ijs7zxuqnoewldef4fauxs7vaax2fab4gcsq\",\n   \"definedTags\": {},\n   \"freeformTags\": {},\n   \"kmsKeyId\": \"ocid1.key.oc1.iad.examplegaag4s.abzwkljsd4iacvbv3s2e57hhwyljoc2zfxcgugfauxafqyxm7ljawezfc3cq\",\n   \"name\": \"test-ca-1\"\n}\n",
  "$defs": {
    "CertificateAuthorityRule": {
      "description": "A rule that you can apply to a certificate authority (CA) to enforce certain conditions on its usage and management.",
      "properties": {
        "ruleType": {
          "description": "The type of rule, whether a renewal rule regarding when to renew the CA or an issuance expiry rule that governs how long the certificates and CAs issued by the CA are valid. (For internal use only) An internal issuance rule defines the number and type of certificates that the CA can issue.\n",
          "enum": [
            "CERTIFICATE_AUTHORITY_ISSUANCE_EXPIRY_RULE",
            "CERTIFICATE_AUTHORITY_ISSUANCE_RULE"
          ],
          "type": "string"
        }
      },
      "required": [
        "ruleType"
      ],
      "type": "object",
      "x-example": "{\n  \"ruleType\": \"CERTIFICATE_AUTHORITY_ISSUANCE_EXPIRY_RULE\"\n}\n"
    },
    "CertificateRevocationListDetails": {
      "description": "The details of the certificate revocation list (CRL).",
      "properties": {
        "customFormattedUrls": {
          "default": null,
          "description": "Optional CRL access points, expressed using a format where the version number of the issuing CA is inserted wherever you include a pair of curly braces. This versioning scheme helps avoid collisions when new CA versions are created. For example, myCrlFileIssuedFromCAVersion{}.crl becomes myCrlFileIssuedFromCAVersion2.crl for CA version 2.\n",
          "items": {
            "maxLength": 256,
            "minLength": 1,
            "type": "string"
          },
          "type": "array"
        },
        "objectStorageConfig": {
          "$ref": "#/$defs/ObjectStorageBucketConfigDetails"
        }
      },
      "required": [
        "objectStorageConfig"
      ],
      "type": "object",
      "x-example": "{\n  \"objectStorageConfig\": {\n     \"objectStorageBucketName\": \"ca-crl-bucket\",\n     \"objectStorageNamespace\": \"example-namespace\",\n     \"objectStorageObjectNameFormat\": \"ca-1-crl\"\n  }\n}\n"
    },
    "CreateCertificateAuthorityConfigDetails": {
      "description": "The configuration details for creating a certificate authority (CA).",
      "properties": {
        "configType": {
          "description": "The origin of the CA.",
          "enum": [
            "ROOT_CA_GENERATED_INTERNALLY",
            "SUBORDINATE_CA_ISSUED_BY_INTERNAL_CA",
            "ROOT_CA_MANAGED_EXTERNALLY",
            "SUBORDINATE_CA_MANAGED_INTERNALLY_ISSUED_BY_EXTERNAL_CA"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/CertificateAuthorityConfigType"
        },
        "versionName": {
          "default": null,
          "description": "The name of the CA version. When the value is not null, a name is unique across versions of a given CA.\n",
          "maxLength": 50,
          "minLength": 1,
          "type": "string"
        }
      },
      "required": [
        "configType"
      ],
      "type": "object",
      "x-example": "{\n  \"configType\": \"ROOT_CA_GENERATED_INTERNALLY\",\n  \"signingAlgorithm\": \"SHA512_WITH_RSA\",\n  \"subject\": {\n     \"commonName\": \"www.example.com\"\n  },\n  \"validity\": {\n     \"timeOfValidityNotAfter\": \"2031-05-06T00:00:00.000Z\"\n  }\n}\n"
    },
    "ObjectStorageBucketConfigDetails": {
      "description": "The details of the Object Storage bucket configured to store the certificate revocation list (CRL).",
      "properties": {
        "objectStorageBucketName": {
          "description": "The name of the bucket where the CRL is stored.",
          "maxLength": 256,
          "minLength": 1,
          "type": "string"
        },
        "objectStorageNamespace": {
          "description": "The tenancy of the bucket where the CRL is stored.",
          "minLength": 1,
          "type": "string",
          "x-default-description": "If not provided, the certificate's tenancy is used."
        },
        "objectStorageObjectNameFormat": {
          "description": "The object name in the bucket where the CRL is stored, expressed using a format where the version number of the issuing CA is inserted as part of the Object Storage object name wherever you include a pair of curly braces. This versioning scheme helps avoid collisions when new CA versions are created. For example, myCrlFileIssuedFromCAVersion{}.crl becomes myCrlFileIssuedFromCAVersion2.crl for CA version 2.\n",
          "maxLength": 1024,
          "minLength": 1,
          "type": "string"
        }
      },
      "required": [
        "objectStorageBucketName",
        "objectStorageObjectNameFormat"
      ],
      "type": "object",
      "x-example": "{\n  \"objectStorageBucketName\": \"ca-crl-bucket\",\n  \"objectStorageNamespace\": \"example-namespace\",\n  \"objectStorageObjectNameFormat\": \"ca-1-crl\"\n}\n"
    }
  }
}