{
  "openapi": "3.0.3",
  "info": {
    "title": "TLS Certificate API",
    "version": "1.0.0",
    "description": "TLS certificate lifecycle \u2014 certificates, certificate authorities, ACME, and TLS profiles."
  },
  "servers": [
    {
      "url": "https://versus-demo.com"
    }
  ],
  "paths": {
    "/api/acme-server/accounts/": {
      "get": {
        "operationId": "acme_server_accounts_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "query",
            "name": "ca",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "status",
            "schema": {
              "type": "string",
              "enum": [
                "deactivated",
                "revoked",
                "valid"
              ]
            },
            "description": "* `valid` - Valid\n* `deactivated` - Deactivated\n* `revoked` - Revoked"
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedAcmeAccountList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List accounts"
      }
    },
    "/api/acme-server/accounts/{id}/": {
      "get": {
        "operationId": "acme_server_accounts_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this acme account.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcmeAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve account"
      }
    },
    "/api/acme-server/accounts/{id}/deactivate/": {
      "post": {
        "operationId": "acme_server_accounts_deactivate_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this acme account.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AcmeAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/AcmeAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/AcmeAccountRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcmeAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Deactivate: account"
      }
    },
    "/api/acme-server/ca/": {
      "get": {
        "operationId": "acme_server_ca_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedInternalCAList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List cas"
      },
      "post": {
        "operationId": "acme_server_ca_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "acme-server"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create ca"
      }
    },
    "/api/acme-server/ca/{id}/": {
      "get": {
        "operationId": "acme_server_ca_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve ca"
      },
      "put": {
        "operationId": "acme_server_ca_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update ca"
      },
      "patch": {
        "operationId": "acme_server_ca_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedInternalCARequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedInternalCARequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedInternalCARequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update ca"
      },
      "delete": {
        "operationId": "acme_server_ca_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete ca"
      }
    },
    "/api/acme-server/ca/{id}/ca_cert/": {
      "get": {
        "operationId": "acme_server_ca_ca_cert_retrieve",
        "description": "Download the CA certificate as PEM (for distributing to clients).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Ca cert: ca"
      }
    },
    "/api/acme-server/ca/{id}/directory_url/": {
      "get": {
        "operationId": "acme_server_ca_directory_url_retrieve",
        "description": "Return the ACME directory URL for this CA.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Directory url: ca"
      }
    },
    "/api/acme-server/ca/{id}/generate_ca/": {
      "post": {
        "operationId": "acme_server_ca_generate_ca_create",
        "description": "Generate a new CA key and self-signed certificate for this CA config.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this Internal CA.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/InternalCARequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InternalCA"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Generate ca: ca"
      }
    },
    "/api/acme-server/orders/": {
      "get": {
        "operationId": "acme_server_orders_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "status",
            "schema": {
              "type": "string",
              "enum": [
                "invalid",
                "pending",
                "processing",
                "ready",
                "valid"
              ]
            },
            "description": "* `pending` - Pending\n* `ready` - Ready\n* `processing` - Processing\n* `valid` - Valid\n* `invalid` - Invalid"
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedAcmeOrderList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List orders"
      }
    },
    "/api/acme-server/orders/{id}/": {
      "get": {
        "operationId": "acme_server_orders_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this acme order.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcmeOrder"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve order"
      }
    },
    "/api/acme-server/orders/{id}/certificate/": {
      "get": {
        "operationId": "acme_server_orders_certificate_retrieve",
        "description": "Download issued certificate PEM.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this acme order.",
            "required": true
          }
        ],
        "tags": [
          "acme-server"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AcmeOrder"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Certificate: order"
      }
    },
    "/api/certificates/": {
      "get": {
        "operationId": "certificates_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "query",
            "name": "device",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "certificates"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedCertificateList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List certificates"
      },
      "post": {
        "operationId": "certificates_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "certificates"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Certificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create certificate"
      }
    },
    "/api/certificates/{id}/": {
      "get": {
        "operationId": "certificates_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate.",
            "required": true
          }
        ],
        "tags": [
          "certificates"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Certificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve certificate"
      },
      "put": {
        "operationId": "certificates_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate.",
            "required": true
          }
        ],
        "tags": [
          "certificates"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Certificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update certificate"
      },
      "patch": {
        "operationId": "certificates_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate.",
            "required": true
          }
        ],
        "tags": [
          "certificates"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Certificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update certificate"
      },
      "delete": {
        "operationId": "certificates_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate.",
            "required": true
          }
        ],
        "tags": [
          "certificates"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete certificate"
      }
    },
    "/api/certs/certificates/": {
      "get": {
        "operationId": "certs_certificates_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "query",
            "name": "auto_renew",
            "schema": {
              "type": "boolean"
            }
          },
          {
            "in": "query",
            "name": "ca_account",
            "schema": {
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "key_source",
            "schema": {
              "type": "string",
              "enum": [
                "adc",
                "versus"
              ]
            },
            "description": "* `versus` - Versus-generated (key stored in Versus)\n* `adc` - ADC-generated (key stays on device)"
          },
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "status",
            "schema": {
              "type": "string",
              "enum": [
                "deployed",
                "draft",
                "expired",
                "expiring",
                "failed",
                "issued",
                "pending_approval",
                "pending_issuance",
                "revoked"
              ]
            },
            "description": "* `draft` - Draft\n* `pending_approval` - Pending Approval\n* `pending_issuance` - Pending Issuance\n* `issued` - Issued\n* `deployed` - Deployed\n* `expiring` - Expiring Soon\n* `expired` - Expired\n* `revoked` - Revoked\n* `failed` - Failed"
          }
        ],
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedManagedCertificateListList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List certificates"
      },
      "post": {
        "operationId": "certs_certificates_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create certificate"
      }
    },
    "/api/certs/certificates/{id}/": {
      "get": {
        "operationId": "certs_certificates_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve certificate"
      },
      "put": {
        "operationId": "certs_certificates_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update certificate"
      },
      "patch": {
        "operationId": "certs_certificates_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedManagedCertificateRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update certificate"
      },
      "delete": {
        "operationId": "certs_certificates_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete certificate"
      }
    },
    "/api/certs/certificates/{id}/approve/": {
      "post": {
        "operationId": "certs_certificates_approve_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Approve: certificate"
      }
    },
    "/api/certs/certificates/{id}/chain/": {
      "get": {
        "operationId": "certs_certificates_chain_retrieve",
        "description": "Return the parsed certificate chain for display.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Chain: certificate"
      }
    },
    "/api/certs/certificates/{id}/deploy/": {
      "post": {
        "operationId": "certs_certificates_deploy_create",
        "description": "Start the 'cert-deploy' workflow for this managed certificate: discover\nevery managed device / SSL profile that serves it (by CN/SAN) and push the\ncert (overwrite in place, or new-name + rebind per the cert's\ndeployment_mode). Returns the workflow run id to follow.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Deploy: certificate"
      }
    },
    "/api/certs/certificates/{id}/discover_targets/": {
      "post": {
        "operationId": "certs_certificates_discover_targets_create",
        "description": "Auto-discover the device/SSL-profile targets that currently serve this\ncertificate (matched by CN/SAN). Returns the list for the UI to review and\nsave; does not persist.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Discover targets: certificate"
      }
    },
    "/api/certs/certificates/{id}/reject/": {
      "post": {
        "operationId": "certs_certificates_reject_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this managed certificate.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/ManagedCertificateRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Reject: certificate"
      }
    },
    "/api/certs/certificates/expiring_soon/": {
      "get": {
        "operationId": "certs_certificates_expiring_soon_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ManagedCertificate"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List expiring soons"
      }
    },
    "/api/certs/deployments/": {
      "get": {
        "operationId": "certs_deployments_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "query",
            "name": "certificate",
            "schema": {
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "device",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "status",
            "schema": {
              "type": "string",
              "enum": [
                "deployed",
                "failed",
                "removed"
              ]
            },
            "description": "* `deployed` - Deployed\n* `failed` - Failed\n* `removed` - Removed"
          }
        ],
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedCertificateDeploymentList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List deployments"
      }
    },
    "/api/certs/deployments/{id}/": {
      "get": {
        "operationId": "certs_deployments_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate deployment.",
            "required": true
          }
        ],
        "tags": [
          "certs"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateDeployment"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve deployment"
      }
    },
    "/api/clm/ca-accounts/": {
      "get": {
        "operationId": "clm_ca_accounts_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedCAAccountList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List ca accounts"
      },
      "post": {
        "operationId": "clm_ca_accounts_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create ca account"
      }
    },
    "/api/clm/ca-accounts/{id}/": {
      "get": {
        "operationId": "clm_ca_accounts_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve ca account"
      },
      "put": {
        "operationId": "clm_ca_accounts_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update ca account"
      },
      "patch": {
        "operationId": "clm_ca_accounts_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCAAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCAAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCAAccountRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update ca account"
      },
      "delete": {
        "operationId": "clm_ca_accounts_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete ca account"
      }
    },
    "/api/clm/ca-accounts/{id}/generate_ca/": {
      "post": {
        "operationId": "clm_ca_accounts_generate_ca_create",
        "description": "Generate a self-signed CA key + certificate for a versus_ca account.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Generate ca: ca account"
      }
    },
    "/api/clm/ca-accounts/{id}/register_account/": {
      "post": {
        "operationId": "clm_ca_accounts_register_account_create",
        "description": "Register or recover an ACME account for this CA account.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Register account: ca account"
      }
    },
    "/api/clm/ca-accounts/{id}/test_connection/": {
      "post": {
        "operationId": "clm_ca_accounts_test_connection_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this ca account.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CAAccountRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CAAccount"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Test connection: ca account"
      }
    },
    "/api/clm/certificates/": {
      "get": {
        "operationId": "clm_certificates_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedCertificateRecordListList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List certificates"
      },
      "post": {
        "operationId": "clm_certificates_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create certificate"
      }
    },
    "/api/clm/certificates/{id}/": {
      "get": {
        "operationId": "clm_certificates_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordDetail"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve certificate"
      },
      "put": {
        "operationId": "clm_certificates_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update certificate"
      },
      "patch": {
        "operationId": "clm_certificates_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update certificate"
      },
      "delete": {
        "operationId": "clm_certificates_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete certificate"
      }
    },
    "/api/clm/certificates/{id}/adopt/": {
      "post": {
        "operationId": "clm_certificates_adopt_create",
        "description": "Adopt a discovered inventory cert into operational management: create a\nManagedCertificate from it (CN/SANs/expiry/CA) so it can be renewed and\ndeployed. Key handling:\n  key_mode='renew'  \u2014 no key; a fresh key+cert is minted at first renewal\n  key_mode='upload' \u2014 provide key_pem, or pkcs12_b64 (+ pkcs12_password)",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Adopt: certificate"
      }
    },
    "/api/clm/certificates/{id}/export_pkcs12/": {
      "get": {
        "operationId": "clm_certificates_export_pkcs12_retrieve",
        "description": "Export a certificate + private key as PKCS#12.\nRequires cert_key_export RBAC role + explicit reason query param.\nEvery access is logged in EscrowAccessLog.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Export pkcs12: certificate"
      }
    },
    "/api/clm/certificates/{id}/transition/": {
      "post": {
        "operationId": "clm_certificates_transition_create",
        "description": "Manually transition a certificate to a new lifecycle state.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate record.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Transition: certificate"
      }
    },
    "/api/clm/certificates/import/": {
      "post": {
        "operationId": "clm_certificates_import_create",
        "description": "Import certificates (and optionally private keys) into the CLM inventory.\n\nAccepts multipart/form-data or application/json.\n\nFields:\n  pem_data    \u2014 PEM text (one or more CERTIFICATE / PRIVATE KEY blocks)\n  file        \u2014 uploaded file (.pem .crt .cer .der .p12 .pfx .p7b .p7c)\n  format      \u2014 'auto'(default)|'pem'|'der'|'pkcs12'|'pkcs7'\n  password    \u2014 PKCS#12 passphrase (plain text)\n  import_key  \u2014 'true' to also import embedded private keys\n  owner       \u2014 owner string stored on each CertificateRecord\n  tags        \u2014 comma-separated tag string or JSON array\n  source_label\u2014 provenance label (stored in sources[].source_ref)",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create import"
      }
    },
    "/api/clm/certificates/refresh_expiry/": {
      "post": {
        "operationId": "clm_certificates_refresh_expiry_create",
        "description": "Trigger a bulk expiry lifecycle refresh.",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create refresh expiry"
      }
    },
    "/api/clm/certificates/sync-from-devices/": {
      "post": {
        "operationId": "clm_certificates_sync_from_devices_create",
        "description": "Bulk-import all applications.Certificate records (device-fetched certs)\nthat have PEM data into the CLM inventory.",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateRecordListRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateRecordList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create sync from device"
      }
    },
    "/api/clm/discovery-jobs/": {
      "get": {
        "operationId": "clm_discovery_jobs_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedDiscoveryJobList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List discovery jobs"
      },
      "post": {
        "operationId": "clm_discovery_jobs_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DiscoveryJob"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create discovery job"
      }
    },
    "/api/clm/discovery-jobs/{id}/": {
      "get": {
        "operationId": "clm_discovery_jobs_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this discovery job.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DiscoveryJob"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve discovery job"
      },
      "put": {
        "operationId": "clm_discovery_jobs_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this discovery job.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DiscoveryJob"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update discovery job"
      },
      "patch": {
        "operationId": "clm_discovery_jobs_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this discovery job.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedDiscoveryJobRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedDiscoveryJobRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedDiscoveryJobRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DiscoveryJob"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update discovery job"
      },
      "delete": {
        "operationId": "clm_discovery_jobs_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this discovery job.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete discovery job"
      }
    },
    "/api/clm/discovery-jobs/{id}/cancel/": {
      "post": {
        "operationId": "clm_discovery_jobs_cancel_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this discovery job.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DiscoveryJob"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Cancel: discovery job"
      }
    },
    "/api/clm/discovery-jobs/{id}/run/": {
      "post": {
        "operationId": "clm_discovery_jobs_run_create",
        "description": "Kick off a discovery job in a background thread.",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this discovery job.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/DiscoveryJobRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DiscoveryJob"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Run: discovery job"
      }
    },
    "/api/clm/escrow-access-log/": {
      "get": {
        "operationId": "clm_escrow_access_log_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedEscrowAccessLogList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List escrow access logs"
      }
    },
    "/api/clm/escrow-access-log/{id}/": {
      "get": {
        "operationId": "clm_escrow_access_log_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this escrow access log.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EscrowAccessLog"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve escrow access log"
      }
    },
    "/api/clm/escrow-keys/": {
      "get": {
        "operationId": "clm_escrow_keys_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedEscrowKeyList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List escrow keys"
      }
    },
    "/api/clm/escrow-keys/{id}/": {
      "get": {
        "operationId": "clm_escrow_keys_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this escrow key.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/EscrowKey"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve escrow key"
      }
    },
    "/api/clm/profiles/": {
      "get": {
        "operationId": "clm_profiles_list",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedCertificateProfileList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List profiles"
      },
      "post": {
        "operationId": "clm_profiles_create",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateProfileRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateProfileRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateProfileRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "201": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateProfile"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Create profile"
      }
    },
    "/api/clm/profiles/{id}/": {
      "get": {
        "operationId": "clm_profiles_retrieve",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate profile.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateProfile"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve profile"
      },
      "put": {
        "operationId": "clm_profiles_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate profile.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CertificateProfileRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/CertificateProfileRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/CertificateProfileRequest"
              }
            }
          },
          "required": true
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateProfile"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update profile"
      },
      "patch": {
        "operationId": "clm_profiles_partial_update",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate profile.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateProfileRequest"
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateProfileRequest"
              }
            },
            "multipart/form-data": {
              "schema": {
                "$ref": "#/components/schemas/PatchedCertificateProfileRequest"
              }
            }
          }
        },
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CertificateProfile"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Update profile"
      },
      "delete": {
        "operationId": "clm_profiles_destroy",
        "description": "Deploy-safe base for making an existing DRF ModelViewSet tenant-isolated\n(VS-SPEC-TENANT-IDENTITY-001 \u00a714). Use as the FIRST base:\n\n    class DeviceViewSet(TenantScopedModelViewSet, viewsets.ModelViewSet):\n        queryset = Device.objects.select_related(...)\n        ...\n\nUnlike the strict TenantScopedViewSet pilot, this **degrades gracefully**:\nit is INERT unless the tenant_scoped alias is configured\n(TENANT_SCOPED_DATABASE_URL) AND the request carries a tenant_id claim.\nWhen inert it behaves exactly like a plain ModelViewSet \u2014 so the rollout\nlands additively and isolation switches on only once the non-superuser\nPostgres role exists (mirrors tenant_subdomain.py's \"inert unless\nconfigured\" contract). When active: reads route through the RLS-enforcing\nconnection and tenant_id is stamped server-side (never client input).",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this certificate profile.",
            "required": true
          }
        ],
        "tags": [
          "clm"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "204": {
            "description": "No response body"
          }
        },
        "summary": "Delete profile"
      }
    },
    "/api/tls-profiles/": {
      "get": {
        "operationId": "tls_profiles_list",
        "parameters": [
          {
            "in": "query",
            "name": "device",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "ordering",
            "required": false,
            "in": "query",
            "description": "Which field to use when ordering the results.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "page",
            "required": false,
            "in": "query",
            "description": "A page number within the paginated result set.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "name": "page_size",
            "required": false,
            "in": "query",
            "description": "Number of results to return per page.",
            "schema": {
              "type": "integer"
            }
          },
          {
            "in": "query",
            "name": "partition",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "search",
            "required": false,
            "in": "query",
            "description": "A search term.",
            "schema": {
              "type": "string"
            }
          },
          {
            "in": "query",
            "name": "side",
            "schema": {
              "type": "string",
              "enum": [
                "client",
                "server"
              ]
            },
            "description": "* `client` - Client SSL\n* `server` - Server SSL"
          }
        ],
        "tags": [
          "tls-profiles"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PaginatedTLSProfileList"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "List tls profiles"
      }
    },
    "/api/tls-profiles/{id}/": {
      "get": {
        "operationId": "tls_profiles_retrieve",
        "parameters": [
          {
            "in": "path",
            "name": "id",
            "schema": {
              "type": "integer"
            },
            "description": "A unique integer value identifying this tls profile.",
            "required": true
          }
        ],
        "tags": [
          "tls-profiles"
        ],
        "security": [
          {
            "jwtAuth": []
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TLSProfile"
                }
              }
            },
            "description": ""
          }
        },
        "summary": "Retrieve tls profile"
      }
    }
  },
  "components": {
    "schemas": {
      "CAAccountDriverEnum": {
        "enum": [
          "versus_ca",
          "acme",
          "digicert",
          "sectigo",
          "entrust",
          "globalsign",
          "adcs",
          "ejbca",
          "vault_pki",
          "aws_pca",
          "gcp_cas",
          "step_ca"
        ],
        "type": "string",
        "description": "* `versus_ca` - Versus Built-in CA (self-signed / internal PKI)\n* `acme` - ACME (Let's Encrypt, ZeroSSL, Buypass, DigiCert ACME\u2026)\n* `digicert` - DigiCert CertCentral REST API\n* `sectigo` - Sectigo / Comodo REST API\n* `entrust` - Entrust Certificate Services\n* `globalsign` - GlobalSign Atlas REST API\n* `adcs` - Microsoft AD CS (SCEP / web-enroll)\n* `ejbca` - EJBCA / Keyfactor EJBCA REST\n* `vault_pki` - HashiCorp Vault PKI\n* `aws_pca` - AWS Private Certificate Authority\n* `gcp_cas` - Google Cloud Certificate Authority Service\n* `step_ca` - Smallstep step-ca"
      },
      "PaginatedEscrowKeyList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/EscrowKey"
            }
          }
        }
      },
      "CertificateRecordDetail": {
        "type": "object",
        "description": "Full serializer including related objects.",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "subject_dn": {
            "type": "string",
            "maxLength": 1000
          },
          "sans": {
            "description": "[{\"type\": \"dns|ip|email|uri\", \"value\": \"...\"}]"
          },
          "serial": {
            "type": "string",
            "readOnly": true
          },
          "fingerprint_sha256": {
            "type": "string",
            "readOnly": true,
            "description": "Primary dedup key (hex SHA-256 of DER)"
          },
          "spki_sha256": {
            "type": "string",
            "readOnly": true,
            "description": "Public-key fingerprint; links rekey lineage"
          },
          "issuer_dn": {
            "type": "string",
            "maxLength": 1000
          },
          "issuing_ca": {
            "type": "integer",
            "nullable": true
          },
          "issuing_ca_name": {
            "type": "string",
            "readOnly": true
          },
          "chain_refs": {
            "readOnly": true,
            "description": "Ordered fingerprint_sha256 refs: leaf \u2192 root"
          },
          "chain_complete": {
            "type": "boolean",
            "readOnly": true
          },
          "is_ca": {
            "type": "boolean"
          },
          "key_algorithm": {
            "allOf": [
              {
                "$ref": "#/components/schemas/KeyAlgorithmE48Enum"
              }
            ],
            "readOnly": true
          },
          "key_size": {
            "type": "integer",
            "readOnly": true,
            "nullable": true
          },
          "curve": {
            "type": "string",
            "readOnly": true
          },
          "sig_algorithm": {
            "type": "string",
            "readOnly": true
          },
          "pq_status": {
            "allOf": [
              {
                "$ref": "#/components/schemas/PqStatusEnum"
              }
            ],
            "readOnly": true
          },
          "not_before": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "lifecycle_state": {
            "$ref": "#/components/schemas/LifecycleStateEnum"
          },
          "days_until_expiry": {
            "type": "integer",
            "readOnly": true
          },
          "sources": {
            "readOnly": true,
            "description": "[{driver, source_ref, first_seen, last_seen}]"
          },
          "first_seen": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "last_seen": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "key_material_info": {
            "allOf": [
              {
                "$ref": "#/components/schemas/EscrowKey"
              }
            ],
            "readOnly": true
          },
          "hsm_backed": {
            "type": "boolean",
            "readOnly": true
          },
          "profile": {
            "type": "integer",
            "nullable": true
          },
          "profile_name": {
            "type": "string",
            "readOnly": true
          },
          "compliance_score": {
            "type": "integer",
            "readOnly": true,
            "nullable": true
          },
          "violations": {
            "readOnly": true
          },
          "owner": {
            "type": "string",
            "maxLength": 200
          },
          "tags": {},
          "pem": {
            "type": "string",
            "description": "Leaf certificate PEM (for chain-stitch and re-use)"
          },
          "supersedes": {
            "type": "integer",
            "nullable": true
          },
          "state_hash": {
            "type": "string",
            "readOnly": true,
            "description": "SHA-256 of key fields for optimistic concurrency"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "transitions": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CertificateTransition"
            },
            "readOnly": true
          },
          "bindings": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/EndpointBinding"
            },
            "readOnly": true
          }
        },
        "required": [
          "bindings",
          "chain_complete",
          "chain_refs",
          "compliance_score",
          "created_at",
          "curve",
          "days_until_expiry",
          "fingerprint_sha256",
          "first_seen",
          "hsm_backed",
          "id",
          "issuing_ca_name",
          "key_algorithm",
          "key_material_info",
          "key_size",
          "last_seen",
          "not_after",
          "not_before",
          "pq_status",
          "profile_name",
          "serial",
          "sig_algorithm",
          "sources",
          "spki_sha256",
          "state_hash",
          "transitions",
          "updated_at",
          "violations"
        ]
      },
      "InternalCA": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "is_ready": {
            "type": "boolean",
            "readOnly": true
          },
          "account_count": {
            "type": "string",
            "readOnly": true
          },
          "order_count": {
            "type": "string",
            "readOnly": true
          },
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "name": {
            "type": "string",
            "maxLength": 100
          },
          "key_type": {
            "$ref": "#/components/schemas/InternalCAKeyTypeEnum"
          },
          "ca_cert_pem": {
            "type": "string",
            "description": "CA certificate (PEM) \u2014 distribute to clients"
          },
          "enabled": {
            "type": "boolean"
          },
          "default_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "max_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "allow_wildcard": {
            "type": "boolean",
            "description": "Allow *.domain.com in orders"
          },
          "allowed_domains": {
            "description": "Restrict issuance to these domain suffixes. Empty = allow all."
          },
          "terms_of_service_url": {
            "type": "string",
            "maxLength": 500
          },
          "website_url": {
            "type": "string",
            "maxLength": 500
          },
          "caa_identities": {
            "description": "CAA identities, e.g. [\"versus.internal\"]"
          },
          "org_name": {
            "type": "string",
            "maxLength": 200
          },
          "country_code": {
            "type": "string",
            "maxLength": 2
          },
          "validity_years": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "CA certificate validity in years"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "account_count",
          "created_at",
          "id",
          "is_ready",
          "order_count",
          "updated_at"
        ]
      },
      "CertificateRecordListRequest": {
        "type": "object",
        "description": "Lightweight serializer for the inventory grid.",
        "properties": {
          "subject_dn": {
            "type": "string",
            "maxLength": 1000
          },
          "sans": {
            "description": "[{\"type\": \"dns|ip|email|uri\", \"value\": \"...\"}]"
          },
          "serial": {
            "type": "string",
            "maxLength": 100
          },
          "fingerprint_sha256": {
            "type": "string",
            "description": "Primary dedup key (hex SHA-256 of DER)",
            "maxLength": 64
          },
          "not_before": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "lifecycle_state": {
            "$ref": "#/components/schemas/LifecycleStateEnum"
          },
          "key_algorithm": {
            "$ref": "#/components/schemas/KeyAlgorithmE48Enum"
          },
          "key_size": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "curve": {
            "type": "string",
            "maxLength": 50
          },
          "is_ca": {
            "type": "boolean"
          },
          "hsm_backed": {
            "type": "boolean"
          },
          "owner": {
            "type": "string",
            "maxLength": 200
          },
          "tags": {},
          "compliance_score": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "pq_status": {
            "$ref": "#/components/schemas/PqStatusEnum"
          }
        }
      },
      "InternalCARequest": {
        "type": "object",
        "properties": {
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "key_type": {
            "$ref": "#/components/schemas/InternalCAKeyTypeEnum"
          },
          "ca_cert_pem": {
            "type": "string",
            "description": "CA certificate (PEM) \u2014 distribute to clients"
          },
          "enabled": {
            "type": "boolean"
          },
          "default_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "max_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "allow_wildcard": {
            "type": "boolean",
            "description": "Allow *.domain.com in orders"
          },
          "allowed_domains": {
            "description": "Restrict issuance to these domain suffixes. Empty = allow all."
          },
          "terms_of_service_url": {
            "type": "string",
            "maxLength": 500
          },
          "website_url": {
            "type": "string",
            "maxLength": 500
          },
          "caa_identities": {
            "description": "CAA identities, e.g. [\"versus.internal\"]"
          },
          "org_name": {
            "type": "string",
            "maxLength": 200
          },
          "country_code": {
            "type": "string",
            "maxLength": 2
          },
          "validity_years": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "CA certificate validity in years"
          }
        }
      },
      "InternalCAKeyTypeEnum": {
        "enum": [
          "ec256",
          "ec384",
          "rsa2048",
          "rsa4096"
        ],
        "type": "string",
        "description": "* `ec256` - ECDSA P-256 (recommended)\n* `ec384` - ECDSA P-384\n* `rsa2048` - RSA 2048-bit\n* `rsa4096` - RSA 4096-bit"
      },
      "CertificateRecordList": {
        "type": "object",
        "description": "Lightweight serializer for the inventory grid.",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "subject_dn": {
            "type": "string",
            "maxLength": 1000
          },
          "sans": {
            "description": "[{\"type\": \"dns|ip|email|uri\", \"value\": \"...\"}]"
          },
          "serial": {
            "type": "string",
            "maxLength": 100
          },
          "fingerprint_sha256": {
            "type": "string",
            "description": "Primary dedup key (hex SHA-256 of DER)",
            "maxLength": 64
          },
          "not_before": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "lifecycle_state": {
            "$ref": "#/components/schemas/LifecycleStateEnum"
          },
          "key_algorithm": {
            "$ref": "#/components/schemas/KeyAlgorithmE48Enum"
          },
          "key_size": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "curve": {
            "type": "string",
            "maxLength": 50
          },
          "is_ca": {
            "type": "boolean"
          },
          "hsm_backed": {
            "type": "boolean"
          },
          "owner": {
            "type": "string",
            "maxLength": 200
          },
          "tags": {},
          "days_until_expiry": {
            "type": "integer",
            "readOnly": true
          },
          "binding_count": {
            "type": "string",
            "readOnly": true
          },
          "compliance_score": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "pq_status": {
            "$ref": "#/components/schemas/PqStatusEnum"
          },
          "first_seen": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "last_seen": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "managed_cert_id": {
            "type": "string",
            "readOnly": true
          }
        },
        "required": [
          "binding_count",
          "days_until_expiry",
          "first_seen",
          "id",
          "last_seen",
          "managed_cert_id"
        ]
      },
      "KeyAlgorithmE48Enum": {
        "enum": [
          "rsa",
          "ecdsa",
          "eddsa",
          "ml_dsa",
          "slh_dsa",
          "unknown"
        ],
        "type": "string",
        "description": "* `rsa` - RSA\n* `ecdsa` - ECDSA\n* `eddsa` - EdDSA\n* `ml_dsa` - ML-DSA (PQC)\n* `slh_dsa` - SLH-DSA (PQC)\n* `unknown` - Unknown"
      },
      "PaginatedTLSProfileList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/TLSProfile"
            }
          }
        }
      },
      "PatchedCertificateRecordListRequest": {
        "type": "object",
        "description": "Lightweight serializer for the inventory grid.",
        "properties": {
          "subject_dn": {
            "type": "string",
            "maxLength": 1000
          },
          "sans": {
            "description": "[{\"type\": \"dns|ip|email|uri\", \"value\": \"...\"}]"
          },
          "serial": {
            "type": "string",
            "maxLength": 100
          },
          "fingerprint_sha256": {
            "type": "string",
            "description": "Primary dedup key (hex SHA-256 of DER)",
            "maxLength": 64
          },
          "not_before": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "lifecycle_state": {
            "$ref": "#/components/schemas/LifecycleStateEnum"
          },
          "key_algorithm": {
            "$ref": "#/components/schemas/KeyAlgorithmE48Enum"
          },
          "key_size": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "curve": {
            "type": "string",
            "maxLength": 50
          },
          "is_ca": {
            "type": "boolean"
          },
          "hsm_backed": {
            "type": "boolean"
          },
          "owner": {
            "type": "string",
            "maxLength": 200
          },
          "tags": {},
          "compliance_score": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "pq_status": {
            "$ref": "#/components/schemas/PqStatusEnum"
          }
        }
      },
      "CAAccount": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "name": {
            "type": "string",
            "maxLength": 100
          },
          "driver": {
            "$ref": "#/components/schemas/CAAccountDriverEnum"
          },
          "config": {
            "description": "Driver-specific config. Common keys: directory_url, account_url, eab_key_id, api_url, org_id, default_validity_days."
          },
          "capabilities": {
            "readOnly": true
          },
          "enabled": {
            "type": "boolean"
          },
          "is_default": {
            "type": "boolean"
          },
          "status": {
            "allOf": [
              {
                "$ref": "#/components/schemas/CAAccountStatusEnum"
              }
            ],
            "readOnly": true
          },
          "status_msg": {
            "type": "string",
            "readOnly": true
          },
          "last_tested": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "notes": {
            "type": "string"
          },
          "has_ca_cert": {
            "type": "string",
            "readOnly": true
          },
          "ca_cert_pem": {
            "type": "string",
            "readOnly": true
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "ca_cert_pem",
          "capabilities",
          "created_at",
          "has_ca_cert",
          "id",
          "last_tested",
          "name",
          "status",
          "status_msg",
          "updated_at"
        ]
      },
      "Certificate": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "device_name": {
            "type": "string",
            "readOnly": true
          },
          "referenced_by": {
            "type": "string",
            "readOnly": true
          },
          "is_builtin": {
            "type": "string",
            "readOnly": true
          },
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "name": {
            "type": "string",
            "maxLength": 300
          },
          "partition": {
            "type": "string",
            "maxLength": 100
          },
          "subject": {
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "expiry_date": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "days_until_expiry": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "serial_number": {
            "type": "string",
            "maxLength": 100
          },
          "subject_alt_names": {
            "type": "string"
          },
          "cert_pem": {
            "type": "string"
          },
          "key_pem_encrypted": {
            "type": "string"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "device": {
            "type": "integer"
          },
          "virtual_server": {
            "type": "integer",
            "nullable": true
          }
        },
        "required": [
          "created_at",
          "device",
          "device_name",
          "id",
          "is_builtin",
          "name",
          "referenced_by"
        ]
      },
      "PaginatedInternalCAList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/InternalCA"
            }
          }
        }
      },
      "CAAccountStatusEnum": {
        "enum": [
          "unchecked",
          "ok",
          "error"
        ],
        "type": "string",
        "description": "* `unchecked` - Not tested\n* `ok` - Connected\n* `error` - Error"
      },
      "PatchedInternalCARequest": {
        "type": "object",
        "properties": {
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "key_type": {
            "$ref": "#/components/schemas/InternalCAKeyTypeEnum"
          },
          "ca_cert_pem": {
            "type": "string",
            "description": "CA certificate (PEM) \u2014 distribute to clients"
          },
          "enabled": {
            "type": "boolean"
          },
          "default_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "max_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "allow_wildcard": {
            "type": "boolean",
            "description": "Allow *.domain.com in orders"
          },
          "allowed_domains": {
            "description": "Restrict issuance to these domain suffixes. Empty = allow all."
          },
          "terms_of_service_url": {
            "type": "string",
            "maxLength": 500
          },
          "website_url": {
            "type": "string",
            "maxLength": 500
          },
          "caa_identities": {
            "description": "CAA identities, e.g. [\"versus.internal\"]"
          },
          "org_name": {
            "type": "string",
            "maxLength": 200
          },
          "country_code": {
            "type": "string",
            "maxLength": 2
          },
          "validity_years": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "CA certificate validity in years"
          }
        }
      },
      "ManagedCertificateRequest": {
        "type": "object",
        "properties": {
          "common_name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 255
          },
          "subject_alt_names": {},
          "organization": {
            "type": "string",
            "maxLength": 200
          },
          "organizational_unit": {
            "type": "string",
            "maxLength": 200
          },
          "country": {
            "type": "string",
            "maxLength": 2
          },
          "state": {
            "type": "string",
            "maxLength": 100
          },
          "city": {
            "type": "string",
            "maxLength": 100
          },
          "key_type": {
            "$ref": "#/components/schemas/KeyTypeE70Enum"
          },
          "ca_account": {
            "type": "integer",
            "nullable": true
          },
          "key_source": {
            "$ref": "#/components/schemas/KeySourceEnum"
          },
          "source_device": {
            "type": "integer",
            "nullable": true
          },
          "pem_certificate": {
            "type": "string",
            "description": "Leaf certificate PEM"
          },
          "pem_chain": {
            "type": "string",
            "description": "Intermediate + root chain PEM"
          },
          "csr_pem": {
            "type": "string"
          },
          "acme_order_url": {
            "type": "string",
            "maxLength": 500
          },
          "deployment_mode": {
            "$ref": "#/components/schemas/DeploymentModeEnum"
          },
          "deployment_targets": {
            "description": "List of {device_id, profile_name, new_cert_name?}"
          },
          "dns_device_id": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true,
            "description": "Fallback DNS device for ACME DNS-01"
          },
          "auto_renew": {
            "type": "boolean"
          }
        },
        "required": [
          "common_name"
        ]
      },
      "KeySourceEnum": {
        "enum": [
          "versus",
          "adc"
        ],
        "type": "string",
        "description": "* `versus` - Versus-generated (key stored in Versus)\n* `adc` - ADC-generated (key stays on device)"
      },
      "PqStatusEnum": {
        "enum": [
          "classical",
          "hybrid",
          "pqc"
        ],
        "type": "string",
        "description": "* `classical` - Classical\n* `hybrid` - Hybrid (classical + PQC)\n* `pqc` - PQC-only"
      },
      "AcmeAccountRequest": {
        "type": "object",
        "properties": {
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "status": {
            "$ref": "#/components/schemas/AcmeAccountStatusEnum"
          },
          "contact": {
            "description": "List of \"mailto:\" URIs"
          },
          "terms_agreed": {
            "type": "boolean"
          },
          "thumbprint": {
            "type": "string",
            "minLength": 1,
            "description": "SHA-256 JWK thumbprint",
            "maxLength": 100
          },
          "ca": {
            "type": "integer"
          }
        },
        "required": [
          "ca",
          "thumbprint"
        ]
      },
      "ActorTypeEnum": {
        "enum": [
          "user",
          "system",
          "driver"
        ],
        "type": "string",
        "description": "* `user` - User\n* `system` - System\n* `driver` - Discovery Driver"
      },
      "PatchedDiscoveryJobRequest": {
        "type": "object",
        "properties": {
          "driver": {
            "$ref": "#/components/schemas/DiscoveryJobDriverEnum"
          },
          "config": {
            "description": "Driver config: targets, ports, device_ids, pem_data, \u2026"
          },
          "schedule": {
            "type": "string",
            "description": "Cron expression for scheduled runs",
            "maxLength": 100
          },
          "created_by": {
            "type": "string",
            "maxLength": 200
          }
        }
      },
      "PaginatedManagedCertificateListList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/ManagedCertificateList"
            }
          }
        }
      },
      "LifecycleStateEnum": {
        "enum": [
          "requested",
          "approved",
          "issued",
          "provisioned",
          "active",
          "renewing",
          "expiring",
          "expired",
          "revoked",
          "retired",
          "failed",
          "rejected",
          "superseded",
          "discovered",
          "unmanaged"
        ],
        "type": "string",
        "description": "* `requested` - Requested\n* `approved` - Approved\n* `issued` - Issued\n* `provisioned` - Provisioned\n* `active` - Active\n* `renewing` - Renewing\n* `expiring` - Expiring\n* `expired` - Expired\n* `revoked` - Revoked\n* `retired` - Retired\n* `failed` - Failed\n* `rejected` - Rejected\n* `superseded` - Superseded\n* `discovered` - Discovered\n* `unmanaged` - Unmanaged"
      },
      "OperationEnum": {
        "enum": [
          "read",
          "export"
        ],
        "type": "string",
        "description": "* `read` - Read (internal use)\n* `export` - Export (PKCS#12)"
      },
      "AcmeOrder": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "account_contact": {
            "readOnly": true
          },
          "ca_name": {
            "type": "string",
            "readOnly": true
          },
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "oid": {
            "type": "string",
            "format": "uuid",
            "readOnly": true
          },
          "status": {
            "$ref": "#/components/schemas/AcmeOrderStatusEnum"
          },
          "identifiers": {
            "description": "[{\"type\":\"dns\",\"value\":\"example.com\"}]"
          },
          "not_before": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "expires": {
            "type": "string",
            "format": "date-time",
            "description": "Order expires if not finalized by this time"
          },
          "error": {
            "nullable": true
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "account": {
            "type": "integer"
          }
        },
        "required": [
          "account",
          "account_contact",
          "ca_name",
          "created_at",
          "expires",
          "id",
          "identifiers",
          "oid",
          "updated_at"
        ]
      },
      "TLSProfile": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "device_name": {
            "type": "string",
            "readOnly": true
          },
          "referenced_by": {
            "type": "string",
            "readOnly": true
          },
          "is_builtin": {
            "type": "string",
            "readOnly": true
          },
          "name": {
            "type": "string",
            "maxLength": 300
          },
          "partition": {
            "type": "string",
            "default": "Common",
            "maxLength": 100
          },
          "side": {
            "$ref": "#/components/schemas/SideEnum"
          },
          "cert": {
            "type": "string",
            "maxLength": 300
          },
          "key": {
            "type": "string",
            "maxLength": 300
          },
          "chain": {
            "type": "string",
            "maxLength": 300
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "device": {
            "type": "integer"
          }
        },
        "required": [
          "created_at",
          "device",
          "device_name",
          "id",
          "is_builtin",
          "name",
          "referenced_by",
          "side",
          "updated_at"
        ]
      },
      "PaginatedCertificateDeploymentList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CertificateDeployment"
            }
          }
        }
      },
      "PaginatedCertificateProfileList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CertificateProfile"
            }
          }
        }
      },
      "CertificateTransition": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "from_state": {
            "type": "string",
            "readOnly": true
          },
          "to_state": {
            "type": "string",
            "readOnly": true
          },
          "actor_type": {
            "allOf": [
              {
                "$ref": "#/components/schemas/ActorTypeEnum"
              }
            ],
            "readOnly": true
          },
          "actor_id": {
            "type": "string",
            "readOnly": true
          },
          "reason": {
            "type": "string",
            "readOnly": true
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "actor_id",
          "actor_type",
          "created_at",
          "from_state",
          "id",
          "reason",
          "to_state"
        ]
      },
      "PatchedCertificateProfileRequest": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "ca_account": {
            "type": "integer",
            "nullable": true
          },
          "key_algorithm": {
            "$ref": "#/components/schemas/CertificateProfileKeyAlgorithmEnum"
          },
          "key_size": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "curve": {
            "type": "string",
            "description": "ECDSA: P-256, P-384. EdDSA: Ed25519.",
            "maxLength": 50
          },
          "custody": {
            "$ref": "#/components/schemas/CustodyEnum"
          },
          "hsm_source": {
            "type": "integer",
            "nullable": true,
            "description": "HSM to use when custody=hsm"
          },
          "max_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "san_constraints": {
            "description": "{\"allowed_domains\": [\"*.corp.com\"], \"forbidden\": []}"
          },
          "auto_renew": {
            "type": "boolean"
          },
          "renew_threshold_pct": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "Renew when this % of validity remains"
          },
          "renew_floor_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "Minimum days-before-expiry floor for renewal trigger"
          },
          "notes": {
            "type": "string"
          }
        }
      },
      "DeploymentModeEnum": {
        "enum": [
          "overwrite",
          "rename_update"
        ],
        "type": "string",
        "description": "* `overwrite` - Overwrite existing cert\n* `rename_update` - New name + update SSL profile"
      },
      "Status2a1Enum": {
        "enum": [
          "draft",
          "pending_approval",
          "pending_issuance",
          "issued",
          "deployed",
          "expiring",
          "expired",
          "revoked",
          "failed"
        ],
        "type": "string",
        "description": "* `draft` - Draft\n* `pending_approval` - Pending Approval\n* `pending_issuance` - Pending Issuance\n* `issued` - Issued\n* `deployed` - Deployed\n* `expiring` - Expiring Soon\n* `expired` - Expired\n* `revoked` - Revoked\n* `failed` - Failed"
      },
      "CertificateProfile": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "name": {
            "type": "string",
            "maxLength": 100
          },
          "ca_account": {
            "type": "integer",
            "nullable": true
          },
          "ca_account_name": {
            "type": "string",
            "readOnly": true
          },
          "key_algorithm": {
            "$ref": "#/components/schemas/CertificateProfileKeyAlgorithmEnum"
          },
          "key_size": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "curve": {
            "type": "string",
            "description": "ECDSA: P-256, P-384. EdDSA: Ed25519.",
            "maxLength": 50
          },
          "custody": {
            "$ref": "#/components/schemas/CustodyEnum"
          },
          "hsm_source": {
            "type": "integer",
            "nullable": true,
            "description": "HSM to use when custody=hsm"
          },
          "hsm_source_name": {
            "type": "string",
            "readOnly": true
          },
          "max_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "san_constraints": {
            "description": "{\"allowed_domains\": [\"*.corp.com\"], \"forbidden\": []}"
          },
          "auto_renew": {
            "type": "boolean"
          },
          "renew_threshold_pct": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "Renew when this % of validity remains"
          },
          "renew_floor_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "Minimum days-before-expiry floor for renewal trigger"
          },
          "notes": {
            "type": "string"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "ca_account_name",
          "created_at",
          "hsm_source_name",
          "id",
          "name",
          "updated_at"
        ]
      },
      "PatchedManagedCertificateRequest": {
        "type": "object",
        "properties": {
          "common_name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 255
          },
          "subject_alt_names": {},
          "organization": {
            "type": "string",
            "maxLength": 200
          },
          "organizational_unit": {
            "type": "string",
            "maxLength": 200
          },
          "country": {
            "type": "string",
            "maxLength": 2
          },
          "state": {
            "type": "string",
            "maxLength": 100
          },
          "city": {
            "type": "string",
            "maxLength": 100
          },
          "key_type": {
            "$ref": "#/components/schemas/KeyTypeE70Enum"
          },
          "ca_account": {
            "type": "integer",
            "nullable": true
          },
          "key_source": {
            "$ref": "#/components/schemas/KeySourceEnum"
          },
          "source_device": {
            "type": "integer",
            "nullable": true
          },
          "pem_certificate": {
            "type": "string",
            "description": "Leaf certificate PEM"
          },
          "pem_chain": {
            "type": "string",
            "description": "Intermediate + root chain PEM"
          },
          "csr_pem": {
            "type": "string"
          },
          "acme_order_url": {
            "type": "string",
            "maxLength": 500
          },
          "deployment_mode": {
            "$ref": "#/components/schemas/DeploymentModeEnum"
          },
          "deployment_targets": {
            "description": "List of {device_id, profile_name, new_cert_name?}"
          },
          "dns_device_id": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true,
            "description": "Fallback DNS device for ACME DNS-01"
          },
          "auto_renew": {
            "type": "boolean"
          }
        }
      },
      "EscrowAccessLog": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "escrow_key": {
            "type": "integer",
            "readOnly": true
          },
          "operation": {
            "allOf": [
              {
                "$ref": "#/components/schemas/OperationEnum"
              }
            ],
            "readOnly": true
          },
          "actor": {
            "type": "string",
            "readOnly": true
          },
          "reason": {
            "type": "string",
            "readOnly": true
          },
          "ip_address": {
            "type": "string",
            "readOnly": true
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "actor",
          "created_at",
          "escrow_key",
          "id",
          "ip_address",
          "operation",
          "reason"
        ]
      },
      "EscrowKeyKindEnum": {
        "enum": [
          "cert_key",
          "acme_account"
        ],
        "type": "string",
        "description": "* `cert_key` - Certificate Private Key\n* `acme_account` - ACME Account Key"
      },
      "PaginatedDiscoveryJobList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/DiscoveryJob"
            }
          }
        }
      },
      "EndpointBinding": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "certificate": {
            "type": "integer"
          },
          "device": {
            "type": "integer",
            "nullable": true
          },
          "device_name": {
            "type": "string",
            "readOnly": true
          },
          "binding_type": {
            "allOf": [
              {
                "$ref": "#/components/schemas/BindingTypeEnum"
              }
            ],
            "default": "generic"
          },
          "binding_key": {
            "type": "string",
            "description": "vserver/profile/listener ID on the device",
            "maxLength": 500
          },
          "served": {
            "type": "boolean",
            "description": "True after handshake verification"
          },
          "last_seen": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "last_verified": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          }
        },
        "required": [
          "binding_key",
          "certificate",
          "device",
          "device_name",
          "id"
        ]
      },
      "CAAccountRequest": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "driver": {
            "$ref": "#/components/schemas/CAAccountDriverEnum"
          },
          "config": {
            "description": "Driver-specific config. Common keys: directory_url, account_url, eab_key_id, api_url, org_id, default_validity_days."
          },
          "api_key": {
            "type": "string",
            "writeOnly": true
          },
          "api_secret": {
            "type": "string",
            "writeOnly": true
          },
          "enabled": {
            "type": "boolean"
          },
          "is_default": {
            "type": "boolean"
          },
          "notes": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ]
      },
      "ManagedCertificateList": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "common_name": {
            "type": "string",
            "maxLength": 255
          },
          "subject_alt_names": {},
          "key_type": {
            "$ref": "#/components/schemas/KeyTypeE70Enum"
          },
          "ca_name": {
            "type": "string",
            "readOnly": true
          },
          "status": {
            "$ref": "#/components/schemas/Status2a1Enum"
          },
          "serial_number": {
            "type": "string",
            "maxLength": 100
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "days_until_expiry": {
            "type": "integer",
            "readOnly": true
          },
          "auto_renew": {
            "type": "boolean"
          },
          "ari_renewal_after": {
            "type": "string",
            "format": "date-time",
            "nullable": true,
            "description": "ARI-suggested earliest renewal time"
          },
          "deployment_count": {
            "type": "string",
            "readOnly": true
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "ca_name",
          "common_name",
          "created_at",
          "days_until_expiry",
          "deployment_count",
          "id"
        ]
      },
      "PatchedCAAccountRequest": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "driver": {
            "$ref": "#/components/schemas/CAAccountDriverEnum"
          },
          "config": {
            "description": "Driver-specific config. Common keys: directory_url, account_url, eab_key_id, api_url, org_id, default_validity_days."
          },
          "api_key": {
            "type": "string",
            "writeOnly": true
          },
          "api_secret": {
            "type": "string",
            "writeOnly": true
          },
          "enabled": {
            "type": "boolean"
          },
          "is_default": {
            "type": "boolean"
          },
          "notes": {
            "type": "string"
          }
        }
      },
      "PaginatedAcmeAccountList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/AcmeAccount"
            }
          }
        }
      },
      "BindingTypeEnum": {
        "enum": [
          "f5_clientssl_profile",
          "netscaler_ssl_vserver",
          "a10_ssl_template",
          "alteon_ssl_policy",
          "avi_sslkeyandcert",
          "kemp_vs_cert",
          "generic"
        ],
        "type": "string",
        "description": "* `f5_clientssl_profile` - F5 BIG-IP Client-SSL Profile\n* `netscaler_ssl_vserver` - Citrix NetScaler SSL vServer\n* `a10_ssl_template` - A10 Networks SSL Template\n* `alteon_ssl_policy` - Radware Alteon SSL Policy\n* `avi_sslkeyandcert` - VMware NSX ALB SSL Key & Cert\n* `kemp_vs_cert` - Kemp LoadMaster VS Certificate\n* `generic` - Generic / Other"
      },
      "PaginatedCAAccountList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CAAccount"
            }
          }
        }
      },
      "PaginatedAcmeOrderList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/AcmeOrder"
            }
          }
        }
      },
      "DiscoveryJobDriverEnum": {
        "enum": [
          "network_scan",
          "import",
          "endpoint_pull"
        ],
        "type": "string",
        "description": "* `network_scan` - Network / TLS Scan\n* `import` - PEM / DER / PKCS#7 Import\n* `endpoint_pull` - Endpoint Config Pull (ADCs)"
      },
      "KeyTypeE70Enum": {
        "enum": [
          "rsa2048",
          "rsa4096",
          "ec256",
          "ec384"
        ],
        "type": "string",
        "description": "* `rsa2048` - RSA 2048-bit\n* `rsa4096` - RSA 4096-bit\n* `ec256` - ECDSA P-256\n* `ec384` - ECDSA P-384"
      },
      "CustodyEnum": {
        "enum": [
          "centralized",
          "csr_only",
          "hsm"
        ],
        "type": "string",
        "description": "* `centralized` - Centralized Escrow (Versus-managed key)\n* `csr_only` - CSR-Only (customer-supplied key, never escrowed)\n* `hsm` - HSM-Backed (key generated/held in HSM, non-exportable)"
      },
      "PaginatedCertificateRecordListList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CertificateRecordList"
            }
          }
        }
      },
      "PaginatedEscrowAccessLogList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/EscrowAccessLog"
            }
          }
        }
      },
      "CertificateRequest": {
        "type": "object",
        "properties": {
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 300
          },
          "partition": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "subject": {
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "expiry_date": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "days_until_expiry": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "serial_number": {
            "type": "string",
            "maxLength": 100
          },
          "subject_alt_names": {
            "type": "string"
          },
          "cert_pem": {
            "type": "string"
          },
          "key_pem_encrypted": {
            "type": "string"
          },
          "device": {
            "type": "integer"
          },
          "virtual_server": {
            "type": "integer",
            "nullable": true
          }
        },
        "required": [
          "device",
          "name"
        ]
      },
      "PatchedCertificateRequest": {
        "type": "object",
        "properties": {
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 300
          },
          "partition": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "subject": {
            "type": "string"
          },
          "issuer": {
            "type": "string"
          },
          "expiry_date": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "days_until_expiry": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true
          },
          "serial_number": {
            "type": "string",
            "maxLength": 100
          },
          "subject_alt_names": {
            "type": "string"
          },
          "cert_pem": {
            "type": "string"
          },
          "key_pem_encrypted": {
            "type": "string"
          },
          "device": {
            "type": "integer"
          },
          "virtual_server": {
            "type": "integer",
            "nullable": true
          }
        }
      },
      "CertificateDeploymentStatusEnum": {
        "enum": [
          "deployed",
          "failed",
          "removed"
        ],
        "type": "string",
        "description": "* `deployed` - Deployed\n* `failed` - Failed\n* `removed` - Removed"
      },
      "SideEnum": {
        "enum": [
          "client",
          "server"
        ],
        "type": "string",
        "description": "* `client` - Client SSL\n* `server` - Server SSL"
      },
      "EscrowKey": {
        "type": "object",
        "description": "Read-only; wrapped_key and dek_wrapped are intentionally excluded.",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "spki_sha256": {
            "type": "string",
            "readOnly": true,
            "description": "SHA-256 of SubjectPublicKeyInfo"
          },
          "algorithm": {
            "type": "string",
            "readOnly": true
          },
          "key_size": {
            "type": "integer",
            "readOnly": true,
            "nullable": true
          },
          "curve": {
            "type": "string",
            "readOnly": true
          },
          "kind": {
            "allOf": [
              {
                "$ref": "#/components/schemas/EscrowKeyKindEnum"
              }
            ],
            "readOnly": true
          },
          "kek_ref": {
            "type": "string",
            "readOnly": true,
            "description": "KEK identifier: app-master-v1 | hsm:<source_id>:<label>"
          },
          "hsm_source": {
            "type": "integer",
            "readOnly": true,
            "nullable": true
          },
          "hsm_source_name": {
            "type": "string",
            "readOnly": true
          },
          "hsm_key_handle": {
            "type": "string",
            "readOnly": true,
            "description": "Key handle / label on the HSM for HSM-backed keys"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "created_by": {
            "type": "string",
            "readOnly": true
          }
        },
        "required": [
          "algorithm",
          "created_at",
          "created_by",
          "curve",
          "hsm_key_handle",
          "hsm_source",
          "hsm_source_name",
          "id",
          "kek_ref",
          "key_size",
          "kind",
          "spki_sha256"
        ]
      },
      "DiscoveryJobRequest": {
        "type": "object",
        "properties": {
          "driver": {
            "$ref": "#/components/schemas/DiscoveryJobDriverEnum"
          },
          "config": {
            "description": "Driver config: targets, ports, device_ids, pem_data, \u2026"
          },
          "schedule": {
            "type": "string",
            "description": "Cron expression for scheduled runs",
            "maxLength": 100
          },
          "created_by": {
            "type": "string",
            "maxLength": 200
          }
        },
        "required": [
          "driver"
        ]
      },
      "CertificateDeployment": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "device": {
            "type": "integer"
          },
          "device_name": {
            "type": "string",
            "readOnly": true
          },
          "profile_name": {
            "type": "string",
            "description": "F5: /Partition/profile-name; NetScaler: certkey-name",
            "maxLength": 300
          },
          "cert_object_name": {
            "type": "string",
            "description": "Name of the cert object on the device (may differ from profile_name)",
            "maxLength": 300
          },
          "status": {
            "$ref": "#/components/schemas/CertificateDeploymentStatusEnum"
          },
          "deployed_at": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "deployed_by": {
            "type": "string",
            "maxLength": 100
          },
          "last_verified": {
            "type": "string",
            "format": "date-time",
            "nullable": true
          },
          "error": {
            "type": "string"
          }
        },
        "required": [
          "device",
          "device_name",
          "id",
          "profile_name"
        ]
      },
      "AcmeAccount": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "ca_name": {
            "type": "string",
            "readOnly": true
          },
          "order_count": {
            "type": "string",
            "readOnly": true
          },
          "tenant_id": {
            "type": "string",
            "format": "uuid",
            "nullable": true
          },
          "kid": {
            "type": "string",
            "format": "uuid",
            "readOnly": true,
            "description": "Account ID / kid"
          },
          "status": {
            "$ref": "#/components/schemas/AcmeAccountStatusEnum"
          },
          "contact": {
            "description": "List of \"mailto:\" URIs"
          },
          "terms_agreed": {
            "type": "boolean"
          },
          "thumbprint": {
            "type": "string",
            "description": "SHA-256 JWK thumbprint",
            "maxLength": 100
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "ca": {
            "type": "integer"
          }
        },
        "required": [
          "ca",
          "ca_name",
          "created_at",
          "id",
          "kid",
          "order_count",
          "thumbprint",
          "updated_at"
        ]
      },
      "DiscoveryJobStatusEnum": {
        "enum": [
          "pending",
          "running",
          "completed",
          "failed",
          "cancelled"
        ],
        "type": "string",
        "description": "* `pending` - Pending\n* `running` - Running\n* `completed` - Completed\n* `failed` - Failed\n* `cancelled` - Cancelled"
      },
      "AcmeOrderStatusEnum": {
        "enum": [
          "pending",
          "ready",
          "processing",
          "valid",
          "invalid"
        ],
        "type": "string",
        "description": "* `pending` - Pending\n* `ready` - Ready\n* `processing` - Processing\n* `valid` - Valid\n* `invalid` - Invalid"
      },
      "CertificateProfileKeyAlgorithmEnum": {
        "enum": [
          "rsa",
          "ecdsa",
          "eddsa",
          "ml_dsa",
          "slh_dsa"
        ],
        "type": "string",
        "description": "* `rsa` - RSA\n* `ecdsa` - ECDSA\n* `eddsa` - EdDSA\n* `ml_dsa` - ML-DSA (CRYSTALS-Dilithium, PQC)\n* `slh_dsa` - SLH-DSA (SPHINCS+, PQC)"
      },
      "DiscoveryJob": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "driver": {
            "$ref": "#/components/schemas/DiscoveryJobDriverEnum"
          },
          "config": {
            "description": "Driver config: targets, ports, device_ids, pem_data, \u2026"
          },
          "status": {
            "allOf": [
              {
                "$ref": "#/components/schemas/DiscoveryJobStatusEnum"
              }
            ],
            "readOnly": true
          },
          "schedule": {
            "type": "string",
            "description": "Cron expression for scheduled runs",
            "maxLength": 100
          },
          "checkpoint": {
            "readOnly": true,
            "description": "Resumption state (current target index, \u2026)"
          },
          "stats": {
            "readOnly": true,
            "description": "{scanned, found, new, updated, errors}"
          },
          "error": {
            "type": "string",
            "readOnly": true
          },
          "started_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "finished_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "created_by": {
            "type": "string",
            "maxLength": 200
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          }
        },
        "required": [
          "checkpoint",
          "created_at",
          "driver",
          "error",
          "finished_at",
          "id",
          "started_at",
          "stats",
          "status"
        ]
      },
      "CertificateProfileRequest": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "minLength": 1,
            "maxLength": 100
          },
          "ca_account": {
            "type": "integer",
            "nullable": true
          },
          "key_algorithm": {
            "$ref": "#/components/schemas/CertificateProfileKeyAlgorithmEnum"
          },
          "key_size": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "curve": {
            "type": "string",
            "description": "ECDSA: P-256, P-384. EdDSA: Ed25519.",
            "maxLength": 50
          },
          "custody": {
            "$ref": "#/components/schemas/CustodyEnum"
          },
          "hsm_source": {
            "type": "integer",
            "nullable": true,
            "description": "HSM to use when custody=hsm"
          },
          "max_validity_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648
          },
          "san_constraints": {
            "description": "{\"allowed_domains\": [\"*.corp.com\"], \"forbidden\": []}"
          },
          "auto_renew": {
            "type": "boolean"
          },
          "renew_threshold_pct": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "Renew when this % of validity remains"
          },
          "renew_floor_days": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "description": "Minimum days-before-expiry floor for renewal trigger"
          },
          "notes": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ]
      },
      "PaginatedCertificateList": {
        "type": "object",
        "required": [
          "count",
          "results"
        ],
        "properties": {
          "count": {
            "type": "integer",
            "example": 123
          },
          "next": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=4"
          },
          "previous": {
            "type": "string",
            "nullable": true,
            "format": "uri",
            "example": "http://api.example.org/accounts/?page=2"
          },
          "results": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/Certificate"
            }
          }
        }
      },
      "ManagedCertificate": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "common_name": {
            "type": "string",
            "maxLength": 255
          },
          "subject_alt_names": {},
          "organization": {
            "type": "string",
            "maxLength": 200
          },
          "organizational_unit": {
            "type": "string",
            "maxLength": 200
          },
          "country": {
            "type": "string",
            "maxLength": 2
          },
          "state": {
            "type": "string",
            "maxLength": 100
          },
          "city": {
            "type": "string",
            "maxLength": 100
          },
          "key_type": {
            "$ref": "#/components/schemas/KeyTypeE70Enum"
          },
          "ca_account": {
            "type": "integer",
            "nullable": true
          },
          "ca_name": {
            "type": "string",
            "readOnly": true
          },
          "key_source": {
            "$ref": "#/components/schemas/KeySourceEnum"
          },
          "source_device": {
            "type": "integer",
            "nullable": true
          },
          "status": {
            "allOf": [
              {
                "$ref": "#/components/schemas/Status2a1Enum"
              }
            ],
            "readOnly": true
          },
          "pem_certificate": {
            "type": "string",
            "description": "Leaf certificate PEM"
          },
          "pem_chain": {
            "type": "string",
            "description": "Intermediate + root chain PEM"
          },
          "csr_pem": {
            "type": "string"
          },
          "serial_number": {
            "type": "string",
            "readOnly": true
          },
          "fingerprint_sha256": {
            "type": "string",
            "readOnly": true
          },
          "not_before": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "not_after": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true
          },
          "days_until_expiry": {
            "type": "integer",
            "readOnly": true
          },
          "acme_order_url": {
            "type": "string",
            "maxLength": 500
          },
          "ari_cert_id": {
            "type": "string",
            "readOnly": true,
            "description": "ACME ARI cert ID"
          },
          "ari_renewal_after": {
            "type": "string",
            "format": "date-time",
            "readOnly": true,
            "nullable": true,
            "description": "ARI-suggested earliest renewal time"
          },
          "deployment_mode": {
            "$ref": "#/components/schemas/DeploymentModeEnum"
          },
          "deployment_targets": {
            "description": "List of {device_id, profile_name, new_cert_name?}"
          },
          "dns_device_id": {
            "type": "integer",
            "maximum": 2147483647,
            "minimum": -2147483648,
            "nullable": true,
            "description": "Fallback DNS device for ACME DNS-01"
          },
          "auto_renew": {
            "type": "boolean"
          },
          "last_workflow_run": {
            "type": "integer",
            "readOnly": true,
            "nullable": true
          },
          "created_by": {
            "type": "string",
            "readOnly": true
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "readOnly": true
          },
          "deployments": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/CertificateDeployment"
            },
            "readOnly": true
          }
        },
        "required": [
          "ari_cert_id",
          "ari_renewal_after",
          "ca_name",
          "common_name",
          "created_at",
          "created_by",
          "days_until_expiry",
          "deployments",
          "fingerprint_sha256",
          "id",
          "last_workflow_run",
          "not_after",
          "not_before",
          "serial_number",
          "status",
          "updated_at"
        ]
      },
      "AcmeAccountStatusEnum": {
        "enum": [
          "valid",
          "deactivated",
          "revoked"
        ],
        "type": "string",
        "description": "* `valid` - Valid\n* `deactivated` - Deactivated\n* `revoked` - Revoked"
      }
    }
  }
}