> ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # Update specific account extension. > Update specific account extension. ## OpenAPI ````json PATCH /sys/v1/account_extensions/{acct_id} { "openapi": "3.0.0", "info": { "title": "Fortanix DSM REST API", "description": "This is a set of REST APIs for accessing the Fortanix Data Security Manager. This includes APIs for managing accounts, and for performing cryptographic and key management operations. \n\n **Note:** \n- All binary input should be base64-encoded. These fields are marked with `format: byte`. \n- For forward compatibility, any API client is expected to ignore any fields in the response not explicitly mentioned in the documentation. We reserve the right to add new fields at any time to provide new functionality without affecting existing API clients.", "termsOfService": "https://www.fortanix.com/legal/terms/", "contact": { "name": "Fortanix Support", "url": "https://support.fortanix.com/", "email": "support@fortanix.com" }, "license": { "name": "Apache 2.0", "url": "http://www.apache.org/licenses/LICENSE-2.0.html" }, "version": "0.1.0-20260526" }, "servers": [ { "url": "https://amer.smartkey.io" } ], "paths": { "/sys/v1/account_extensions/{acct_id}": { "patch": { "operationId": "UpdateAccountExtension", "tags": [ "Account_extensions" ], "security": [ { "bearerToken": [] }, { "apiKeyAuth": [] } ], "summary": "Update specific account extension.", "description": "Update specific account extension.", "parameters": [ { "name": "acct_id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtensionRequest" } } } }, "responses": { "2XX": { "description": "Success result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AccountExtension" } } } } } } } }, "components": { "schemas": { "AccountExtensionRequest": { "allOf": [ { "type": "object", "properties": { "cryptographic_policy": { "$ref": "#/components/schemas/RemovableCryptographicPolicy" }, "key_history_policy": { "$ref": "#/components/schemas/RemovableKeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/RemovableKeyMetadataPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" }, "nullable": true }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" }, "nullable": true }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/RemovablePluginCodeSigningPolicy" }, "mark_key_disabled_when_deactivated": { "type": "boolean", "nullable": true } } } ] }, "AccountExtension": { "allOf": [ { "type": "object", "properties": { "acct_id": { "type": "string", "format": "uuid" }, "cryptographic_policy": { "$ref": "#/components/schemas/CryptographicPolicy" }, "key_history_policy": { "$ref": "#/components/schemas/KeyHistoryPolicy" }, "key_metadata_policy": { "$ref": "#/components/schemas/KeyMetadataPolicy" }, "custom_metadata": { "type": "object", "additionalProperties": { "type": "string" } }, "custom_metadata_attributes": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/CustomAttributeSearchMetadata" } }, "plugin_code_signing_policy": { "$ref": "#/components/schemas/PluginCodeSigningPolicy" }, "mark_key_disabled_when_deactivated": { "type": "boolean" } }, "required": [ "acct_id", "custom_metadata", "custom_metadata_attributes", "mark_key_disabled_when_deactivated" ] } ] }, "RemovableCryptographicPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/CryptographicPolicy" } ] }, "RemovableKeyHistoryPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/KeyHistoryPolicy" } ] }, "RemovableKeyMetadataPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/KeyMetadataPolicy" } ] }, "CustomAttributeSearchMetadata": { "allOf": [ { "type": "object", "properties": { "suggest": { "type": "boolean", "nullable": true } } } ] }, "RemovablePluginCodeSigningPolicy": { "oneOf": [ { "type": "string", "enum": [ "remove" ] }, { "$ref": "#/components/schemas/PluginCodeSigningPolicy" } ] }, "CryptographicPolicy": { "allOf": [ { "type": "object", "properties": { "aes": { "$ref": "#/components/schemas/AesOptionsPolicy" }, "aria": { "$ref": "#/components/schemas/AriaOptionsPolicy" }, "des3": { "$ref": "#/components/schemas/Des3OptionsPolicy" }, "rsa": { "$ref": "#/components/schemas/RsaOptionsPolicy" }, "hmac": { "$ref": "#/components/schemas/HmacOptionsPolicy" }, "ec": { "$ref": "#/components/schemas/EcOptionsPolicy" }, "legacy_policy": { "$ref": "#/components/schemas/LegacyKeyPolicy" }, "key_ops": { "type": "array", "items": { "$ref": "#/components/schemas/KeyOperations" }, "nullable": true }, "des": { "$ref": "#/components/schemas/DesOptionsPolicy" }, "seed": { "$ref": "#/components/schemas/SeedOptionsPolicy" }, "dsa": { "$ref": "#/components/schemas/DsaOptionsPolicy" }, "kcdsa": { "$ref": "#/components/schemas/KcdsaOptionsPolicy" }, "eckcdsa": { "$ref": "#/components/schemas/EcKcdsaOptionsPolicy" }, "lms": { "$ref": "#/components/schemas/LmsOptionsPolicy" }, "xmss": { "$ref": "#/components/schemas/XmssOptionsPolicy" }, "mldsa": { "$ref": "#/components/schemas/MlDsaOptionsPolicy" }, "mlkem": { "$ref": "#/components/schemas/MlKemOptionsPolicy" }, "bip32": { "$ref": "#/components/schemas/Bip32OptionsPolicy" }, "slip10": { "$ref": "#/components/schemas/Slip10OptionsPolicy" }, "bls": { "$ref": "#/components/schemas/BlsOptionsPolicy" }, "opaque": { "$ref": "#/components/schemas/OpaqueOptionsPolicy" }, "secret": { "$ref": "#/components/schemas/SecretOptionsPolicy" }, "certificate": { "$ref": "#/components/schemas/CertificateOptionsPolicy" } } } ] }, "KeyHistoryPolicy": { "allOf": [ { "type": "object", "description": "Configuration for a key history (aka key undo) policy.", "properties": { "undo_time_window": { "$ref": "#/components/schemas/Secs" } }, "required": [ "undo_time_window" ] } ] }, "KeyMetadataPolicy": { "allOf": [ { "type": "object", "properties": { "base": { "$ref": "#/components/schemas/MetadataPolicyItem" }, "for_obj_type": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/MetadataPolicyItem" }, "description": "Each entry in this map fully overrides `base` for a particular object type." }, "legacy_objects": { "$ref": "#/components/schemas/LegacyKeyPolicy" } }, "required": [ "base", "for_obj_type", "legacy_objects" ] } ] }, "PluginCodeSigningPolicy": { "allOf": [ { "type": "object", "description": "Plugin code signing policy.\n\nWhen a code signing policy is set, all requests to create new plugins or\nupdate existing plugins (if updating the code) would need to provide a valid\nsignature.", "properties": { "signing_keys": { "$ref": "#/components/schemas/SigningKeys" } }, "required": [ "signing_keys" ] } ] }, "AesOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "random_iv": { "type": "boolean", "nullable": true }, "fpe": { "$ref": "#/components/schemas/FpeOptions" } } } ] }, "AriaOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "random_iv": { "type": "boolean", "nullable": true } } } ] }, "Des3OptionsPolicy": { "allOf": [ { "type": "object", "description": "Cryptographic policy for triple DES objects. Setting `key_sizes: [168]`\nforbids two-key triple DES.", "properties": { "key_sizes": { "type": "array", "items": { "type": "integer", "minimum": 0, "maximum": 4294967295 }, "nullable": true }, "random_iv": { "type": "boolean", "nullable": true } } } ] }, "RsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "encryption_policy": { "type": "array", "items": { "$ref": "#/components/schemas/RsaEncryptionPolicy" }, "nullable": true }, "signature_policy": { "type": "array", "items": { "$ref": "#/components/schemas/RsaSignaturePolicy" }, "nullable": true, "description": "Signature policy for an RSA key. When doing a signature operation, the policies are\nevaluated against the specified parameters one by one. If one matches, the operation is\nallowed. If none match, including if the policy list is empty, the operation is disallowed.\nMissing optional parameters will have their defaults specified according to the matched\npolicy. The default for new keys is `[{}]` (no constraints).\nIf (part of) a constraint is not specified, anything is allowed for that constraint." }, "minimum_key_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed key length. This is only relevant for group or account cryptographic\npolicies (and hence has no effect in an RSA policy on a specific key)." } } } ] }, "HmacOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "minimum_key_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true } } } ] }, "EcOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "elliptic_curves": { "type": "array", "items": { "$ref": "#/components/schemas/EllipticCurve" }, "nullable": true } } } ] }, "LegacyKeyPolicy": { "type": "string", "enum": [ "allowed", "prohibited", "unprotect_only" ] }, "KeyOperations": { "description": "Operations allowed to be performed on a given key.\n\n\n\n SIGN:\n If this is set, the key can be used to for signing.\n\n\n VERIFY:\n If this is set, the key can used for verifying a signature.\n\n\n ENCRYPT:\n If this is set, the key can be used for encryption.\n\n\n DECRYPT:\n If this is set, the key can be used for decryption.\n\n\n WRAPKEY:\n If this is set, the key can be used wrapping other keys.\n The key being wrapped must have the EXPORT operation enabled.\n\n\n UNWRAPKEY:\n If this is set, the key can be used to unwrap a wrapped key.\n\n\n DERIVEKEY:\n If this is set, the key can be used to derive another key.\n\n\n TRANSFORM:\n If this is set, the key can be transformed.\n\n\n MACGENERATE:\n If this is set, the key can be used to compute a cryptographic\n Message Authentication Code (MAC) on a message.\n\n\n MACVERIFY:\n If they is set, the key can be used to verify a MAC.\n\n\n EXPORT:\n If this is set, the value of the key can be retrieved\n with an authenticated request. This shouldn't be set unless\n required. It is more secure to keep the key's value inside DSM only.\n\n\n APPMANAGEABLE:\n Without this operation, management operations like delete, destroy,\n rotate, activate, restore, revoke, revert, update, remove_private, etc.\n cannot be performed by a crypto App.\n A user with access or admin app can still perform these operations.\n This option is only relevant for crypto apps.\n\n\n HIGHVOLUME:\n If this is set, audit logs will not be recorded for the key.\n High volume here tries to signify a key that is being used a lot\n and will produce lots of logs. Setting this operation disables\n audit logs for the key.\n\n\n AGREEKEY:\n If this is set, the key can be used for key agreement.\n Both the private and public key should have this option enabled\n to perform an agree operation.\n\n\n ENCAPSULATE:\n If this is set, the key can be used for key encapsulation. The\n result is a new symmetric key and a ciphertext.\n\n\n DECAPSULATE:\n If this is set, the key can be used for key decapsulation. If\n decapsulation succeeds, the result is a new symmetric key.\n\n", "type": "string", "enum": [ "SIGN", "VERIFY", "ENCRYPT", "DECRYPT", "WRAPKEY", "UNWRAPKEY", "DERIVEKEY", "TRANSFORM", "MACGENERATE", "MACVERIFY", "EXPORT", "APPMANAGEABLE", "HIGHVOLUME", "AGREEKEY", "ENCAPSULATE", "DECAPSULATE" ] }, "DesOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "random_iv": { "type": "boolean", "nullable": true } } } ] }, "SeedOptionsPolicy": { "allOf": [ { "type": "object", "properties": { "random_iv": { "type": "boolean", "nullable": true } } } ] }, "DsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "KcdsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "EcKcdsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "LmsOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "XmssOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "MlDsaOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "MlKemOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "Bip32OptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "Slip10OptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "BlsOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "OpaqueOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "SecretOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "CertificateOptionsPolicy": { "allOf": [ { "type": "object", "properties": {} } ] }, "Secs": { "allOf": [ { "type": "integer" } ] }, "MetadataPolicyItem": { "allOf": [ { "type": "object", "properties": { "custom_metadata": { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/MetadataStringConstraint" } }, "description": { "$ref": "#/components/schemas/MetadataStringConstraint" }, "deactivation_date": { "$ref": "#/components/schemas/MetadataDurationConstraint" }, "activation_date": { "$ref": "#/components/schemas/MetadataDurationConstraint" } }, "required": [ "custom_metadata" ] } ] }, "SigningKeys": { "description": "Signing keys used to validate JSON Web Signature objects including signed\nJSON Web Tokens.", "oneOf": [ { "$ref": "#/components/schemas/SigningKeysVariantStored" }, { "$ref": "#/components/schemas/SigningKeysVariantFetched" } ], "discriminator": { "propertyName": "kind", "mapping": { "stored": "SigningKeysVariantStored", "fetched": "SigningKeysVariantFetched" } } }, "FpeOptions": { "description": "FPE-specific options (for specifying the format of the\ndata to be encrypted)", "oneOf": [ { "$ref": "#/components/schemas/FpeOptionsBasic" }, { "$ref": "#/components/schemas/FpeOptionsAdvanced" }, { "$ref": "#/components/schemas/FpeOptionsV2" } ] }, "RsaEncryptionPolicy": { "allOf": [ { "type": "object", "description": "Constraints on RSA encryption parameters. In general, if a constraint is not specified, anything is allowed.", "properties": { "padding": { "$ref": "#/components/schemas/RsaEncryptionPaddingPolicy" } } } ] }, "RsaSignaturePolicy": { "allOf": [ { "type": "object", "description": "Constraints on RSA signature parameters. In general, if a constraint is not specified, anything is allowed.", "properties": { "padding": { "$ref": "#/components/schemas/RsaSignaturePaddingPolicy" } } } ] }, "EllipticCurve": { "description": "Identifies a standardized elliptic curve.", "type": "string", "enum": [ "X25519", "Ed25519", "Ed448", "X448", "SecP192K1", "SecP224K1", "SecP256K1", "NistP192", "NistP224", "NistP256", "NistP384", "NistP521", "Gost256A" ] }, "MetadataStringConstraint": { "oneOf": [ { "title": "MetadataStringConstraintVariantForbidden", "type": "object", "properties": { "forbidden": { "type": "object", "properties": {} } }, "required": [ "forbidden" ] }, { "title": "MetadataStringConstraintVariantRequired", "type": "object", "properties": { "required": { "$ref": "#/components/schemas/MetadataStringConstraintRequired" } }, "required": [ "required" ] } ] }, "MetadataDurationConstraint": { "oneOf": [ { "title": "MetadataDurationConstraintVariantForbidden", "type": "object", "properties": { "forbidden": { "type": "object", "properties": {} } }, "required": [ "forbidden" ] }, { "title": "MetadataDurationConstraintVariantRequired", "type": "object", "properties": { "required": { "$ref": "#/components/schemas/MetadataDurationConstraintRequired" } }, "required": [ "required" ] } ] }, "SigningKeysVariantStored": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "stored" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/SigningKeysStored" } ] }, "SigningKeysVariantFetched": { "allOf": [ { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "fetched" ] } }, "required": [ "kind" ] }, { "$ref": "#/components/schemas/SigningKeysFetched" } ] }, "FpeOptionsBasic": { "allOf": [ { "type": "object", "description": "Basic FPE-specific options. This is suitable for simple datatypes\nthat consist of ASCII digits, or ASCII digits and uppercase letters.", "properties": { "radix": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The FPE base for the input data (i.e., the size of the character\nset of the datatype). This must be an integer from 2 to 36.\n\nThis also implicitly defines the alphabet of the datatype. A base\nfrom 2 to 10 implies ASCII digits (e.g., a radix of 3 can be used\nto represent a ternary string), and a base from 11 to 36 implies\nASCII digits and uppercase letters (e.g., a radix of 16 can be" }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The minimum allowed length for the input data." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The maximum allowed length for the input data." }, "preserve": { "type": "array", "items": { "type": "integer", "format": "int64" }, "description": "The list of indices of characters to be preserved while performing encryption/decryption.\nIndices are Python-like; i.e., nonnegative indices index from the beginning of the input\n(where 0 is the first character), and negative indices index from the end of the input.\n(where -1 is the last character, -2 is second to last, and so on).\n\nAny preserved characters will be concatenated together and used as an FF1 tweak. For example,\nif the input data is \"abcd\", and the first and last characters are to be preserved, the FF1\ntweak will be the ASCII bytes of the string \"ad\"." }, "mask": { "type": "array", "items": { "type": "integer", "format": "int64" }, "nullable": true, "description": "The list of indices of characters to be masked while performing masked decryption.\nIndices are Python-like; i.e., nonnegative indices index from the beginning of the input\n(where 0 is the first character), and negative indices index from the end of the input.\n(where -1 is the last character, -2 is second to last, and so on)." }, "luhn_check": { "type": "boolean", "nullable": true, "description": "Whether the encrypted/decrypted data contains a checksum digit that satisfies the Luhn\nformula. (The output ciphertext/plaintext will also contain a Luhn checksum digit.)" }, "name": { "type": "string", "nullable": true, "description": "The user-provided name for the data type that represents the input data." } }, "required": [ "radix", "min_length", "max_length", "preserve" ] } ] }, "FpeOptionsAdvanced": { "allOf": [ { "type": "object", "description": "Advanced FPE options. It is recommended to use this for\nspecifying any FPE options, as it is more expressive than\nFpeOptionsBasic.", "properties": { "format": { "$ref": "#/components/schemas/FpeDataPart" }, "description": { "type": "string", "nullable": true, "description": "The user-provided name for the data type." } }, "required": [ "format" ] } ] }, "FpeOptionsV2": { "allOf": [ { "type": "object", "properties": { "format_v2": { "$ref": "#/components/schemas/FpeFormatV2" }, "description": { "type": "string", "nullable": true } }, "required": [ "format_v2" ] } ] }, "RsaEncryptionPaddingPolicy": { "description": "RSA encryption padding policy.", "oneOf": [ { "title": "RsaEncryptionPaddingPolicyVariantOaep", "type": "object", "properties": { "OAEP": { "$ref": "#/components/schemas/RsaEncryptionPaddingPolicyOaep" } }, "required": [ "OAEP" ] }, { "title": "RsaEncryptionPaddingPolicyVariantPkcs1V15", "type": "object", "properties": { "PKCS1_V15": { "type": "object", "properties": {} } }, "required": [ "PKCS1_V15" ] }, { "title": "RsaEncryptionPaddingPolicyVariantRawDecrypt", "type": "object", "properties": { "RAW_DECRYPT": { "type": "object", "properties": {} } }, "required": [ "RAW_DECRYPT" ] } ] }, "RsaSignaturePaddingPolicy": { "description": "RSA signature padding policy.", "oneOf": [ { "title": "RsaSignaturePaddingPolicyVariantPss", "type": "object", "properties": { "PSS": { "$ref": "#/components/schemas/RsaSignaturePaddingPolicyPss" } }, "required": [ "PSS" ] }, { "title": "RsaSignaturePaddingPolicyVariantPkcs1V15", "type": "object", "properties": { "PKCS1_V15": { "type": "object", "properties": {} } }, "required": [ "PKCS1_V15" ] } ] }, "MetadataStringConstraintRequired": { "allOf": [ { "type": "object", "properties": { "non_empty_after_trim": { "type": "boolean", "nullable": true, "description": "If set to `true`, the value must have a length > 0 after trimming\nleading and trailing whitespace characters." }, "allowed_values": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "nullable": true, "description": "If not specified or empty, it will not impose any restrictions on the value." } } } ] }, "MetadataDurationConstraintRequired": { "allOf": [ { "type": "object", "properties": { "allowed_values": { "$ref": "#/components/schemas/RestrictedDuration" } } } ] }, "SigningKeysStored": { "allOf": [ { "type": "object", "properties": { "keys": { "type": "object", "additionalProperties": { "type": "string", "format": "byte" }, "description": "Mapping key ids to DER-encoded public key." } }, "required": [ "keys" ] } ] }, "SigningKeysFetched": { "allOf": [ { "type": "object", "properties": { "url": { "type": "string" }, "cache_duration": { "type": "integer", "description": "Number of seconds that the service is allowed to cache the fetched keys." } }, "required": [ "url", "cache_duration" ] } ] }, "FpeDataPart": { "description": "Structure for specifying (part of) a complex tokenization data type.", "oneOf": [ { "$ref": "#/components/schemas/FpeEncryptedPart" }, { "$ref": "#/components/schemas/FpeDataPartLiteral" }, { "$ref": "#/components/schemas/FpeCompoundPart" } ] }, "FpeFormatV2": { "allOf": [ { "type": "object", "description": "The second generation of Fortanix Tokenization scheme.", "properties": { "variants": { "type": "array", "items": { "$ref": "#/components/schemas/FpeVariant" }, "description": "A token is accepted if it is accepted by any of these variants. Note\ntokenization results depend on the order of this list." }, "mode": { "$ref": "#/components/schemas/FpeTokenizeMode" }, "input_processing": { "$ref": "#/components/schemas/FpeInputProcessing" } }, "required": [ "variants" ] } ] }, "RsaEncryptionPaddingPolicyOaep": { "allOf": [ { "type": "object", "description": "The Optional Asymmetric Encryption Padding scheme, as defined\nin RFC 8017 (PKCS #1 version 2.2)", "properties": { "mgf": { "$ref": "#/components/schemas/MgfPolicy" } } } ] }, "RsaSignaturePaddingPolicyPss": { "allOf": [ { "type": "object", "properties": { "mgf": { "$ref": "#/components/schemas/MgfPolicy" } } } ] }, "RestrictedDuration": { "allOf": [ { "type": "object", "properties": { "min": { "$ref": "#/components/schemas/TimeSpan" }, "max": { "$ref": "#/components/schemas/TimeSpan" }, "default": { "$ref": "#/components/schemas/TimeSpan" } } } ] }, "FpeEncryptedPart": { "allOf": [ { "type": "object", "description": "Structure of a tokenized portion of a complex tokenization data type.\n\nImplementation note: the backend parser is locally \"greedy\" and will attempt to match\nas many characters as possible. If this later results in an invalid parse of the rest\nof the input, the backend ***will not backtrack*** and will simply return with an error.", "properties": { "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The maximum allowed length for this part (in chars)." }, "char_set": { "$ref": "#/components/schemas/FpeCharSet" }, "cipher_char_set": { "$ref": "#/components/schemas/FpeCharSet" }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "$ref": "#/components/schemas/FpePreserveMask" }, "mask": { "$ref": "#/components/schemas/FpePreserveMask" } }, "required": [ "min_length", "max_length", "char_set" ] } ] }, "FpeDataPartLiteral": { "allOf": [ { "type": "object", "description": "A section of the data type that is not to be tokenized (e.g., a delimiter).\n\nUnlike preserved characters, literal characters are not used for FF1 tweaks.", "properties": { "literal": { "type": "array", "items": { "type": "string" }, "description": "The list of possible strings that make up this literal portion of the token.\nFor example, if a delimiter can either be a space or a dash, the list would\nbe `[\" \", \"-\"]`.\n\nImplementation note: the backend will pick the first choice that matches when\nwhen parsing the input. If this results in an invalid parse of the rest of the\ninput, the backend ***will not backtrack*** and will simply return with an error." } }, "required": [ "literal" ] } ] }, "FpeCompoundPart": { "description": "Structure of a compound portion of a complex tokenization data type, itself composed of\nsmaller parts.", "oneOf": [ { "$ref": "#/components/schemas/FpeCompoundPartOr" }, { "$ref": "#/components/schemas/FpeCompoundPartConcat" }, { "$ref": "#/components/schemas/FpeCompoundPartMultiple" } ] }, "FpeVariant": { "allOf": [ { "type": "object", "description": "A concatenation of sections.", "properties": { "sections": { "type": "array", "items": { "$ref": "#/components/schemas/FpeSection" } } }, "required": [ "sections" ] } ] }, "FpeTokenizeMode": { "description": "How to tokenize a given input. The most secure option is \"PreserveFormat\".", "type": "string", "enum": [ "preserve_format", "preserve_variant", "preserve_length" ] }, "FpeInputProcessing": { "description": "Options to apply some pre- and post-processing to the input.", "type": "string", "enum": [ "strip_unknown", "passthrough_unknown" ] }, "MgfPolicy": { "description": "MGF policy.", "oneOf": [ { "title": "MgfPolicyVariantMgf1", "type": "object", "properties": { "mgf1": { "$ref": "#/components/schemas/MgfPolicyMgf1" } }, "required": [ "mgf1" ] } ] }, "TimeSpan": { "oneOf": [ { "title": "TimeSpanVariantSeconds", "type": "object", "properties": { "seconds": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "seconds" ] }, { "title": "TimeSpanVariantMinutes", "type": "object", "properties": { "minutes": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "minutes" ] }, { "title": "TimeSpanVariantHours", "type": "object", "properties": { "hours": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "hours" ] }, { "title": "TimeSpanVariantDays", "type": "object", "properties": { "days": { "type": "integer", "minimum": 0, "maximum": 4294967295 } }, "required": [ "days" ] } ] }, "FpeCharSet": { "description": "The alphabet to use for an encrypted portion of a complex tokenization data type.\nCharacters should be specified as a list of pairs, where each pair [a, b] represents the\nrange of Unicode code points from a to b, with both bounds being inclusive. A single\ncode point can be specified as [c, c].\n\nNormally, each character is assigned a numeric value for FF1. The first character is\nassigned a value of 0, and subsequent characters are assigned values of 1, 2, and so on,\nup to the size of the alphabet. Note that the order of the ranges matters; characters\nappearing in later ranges are assigned higher numerical values compared to earlier\ncharacters. For instance, in the FpeCharSet [['a', 'z'], ['0', '9']], the digits '0' to\n'9' are assigned values from 26 to 35, since they are listed after the 'a' to 'z' range.\n\nIn any case, ranges should not overlap with each other, and should not contain surrogate\ncode points.", "allOf": [ { "type": "array", "items": { "type": "array", "minItems": 2, "maxItems": 2, "items": { "type": "string", "minLength": 1, "maxLength": 1 } } } ] }, "FpeConstraints": { "allOf": [ { "type": "object", "description": "Constraints on a portion of a complex tokenization data type.", "properties": { "luhn_check": { "type": "boolean", "nullable": true, "description": "Whether the token part contains a checksum that satisfies the Luhn formula. It is an\nerror to apply this constraint to non-numeric parts, or to have an encrypted part be\nunder more than one Luhn check constraint. Also, if an encrypted part has a Luhn check\nconstraint applied to it and may contain at least one digit that is not preserved, it\nmust not specify any other constraints." }, "num_gt": { "type": "integer", "nullable": true, "description": "Number that the token part should be greater than.\n\nThis constraint can only be specified on (non-compound) numeric encrypted parts\nguaranteed to preserve either everything or nothing at all. (For example, if an\nencrypted part consists of 5 to 10 digits, a `preserve` list that covers only the\nfirst five digits is not guaranteed to preserve everything, because if the input\nhappens to be six or more digits long, there will be at least one digit that\nremains unpreserved.)" }, "num_lt": { "type": "integer", "nullable": true, "description": "Number that the token part should be smaller than.\n\nThis constraint can only be specified on (non-compound) numeric encrypted parts\nguaranteed to preserve either everything or nothing at all. (For example, if an\nencrypted part consists of 5 to 10 digits, a `preserve` list that covers only the\nfirst five digits is not guaranteed to preserve everything, because if the input\nhappens to be six or more digits long, there will be at least one digit that\nremains unpreserved.)" }, "num_ne": { "type": "array", "items": { "type": "integer" }, "nullable": true, "description": "Numbers that the token part should not be equal to. It is an error to apply this\nconstraint to non-numeric parts." }, "date": { "$ref": "#/components/schemas/FpeDateConstraint" }, "applies_to": { "$ref": "#/components/schemas/FpeConstraintsApplicability" } } } ] }, "FpePreserveMask": { "description": "A structure indicating which indices in an encrypted part to mask or preserve.", "oneOf": [ { "$ref": "#/components/schemas/All" }, { "type": "array", "items": { "type": "integer", "format": "int64" }, "description": "Indicates that only certain characters are to be preserved or masked. Indices are\nPython-like; i.e., negative indices index from the end of the token portion, with\nindex -1 denoting the last character. (Indicating that nothing should be preserved\nor masked can be done via an empty list, which is the default value for this enum.)" } ] }, "FpeCompoundPartOr": { "allOf": [ { "type": "object", "description": "Represents an OR of multiple structures.\n\nImplementation note: an OR is _not_ a union of `FpeDataPart`s. Rather, when parsing\nthe input, the backend will simply choose the first subpart that matches the current\nportion of the input, and tokenize/detokenize accordingly. If that choice results in\nan invalid parse of the rest of the input, the backend ***will not backtrack*** and\nwill simply return with an error.", "properties": { "or": { "type": "array", "items": { "$ref": "#/components/schemas/FpeDataPart" }, "description": "The actual subparts that make up this compound part." }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "type": "boolean", "nullable": true, "description": "Whether the entire OR should be preserved as-is (i.e., not tokenized). If this is\nset, any descendant subparts cannot contain any preserve-related fields set." }, "mask": { "type": "boolean", "nullable": true, "description": "Whether the entire OR should be masked when doing masked decryption. If this is set,\nany descendant subparts cannot contain any mask-related fields set." }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The maximum allowed length for this part (in chars)." } }, "required": [ "or" ] } ] }, "FpeCompoundPartConcat": { "allOf": [ { "type": "object", "description": "Represents a concatenation of multiple structures (in a particular order).", "properties": { "concat": { "type": "array", "items": { "$ref": "#/components/schemas/FpeDataPart" }, "description": "The actual subparts that make up this compound part, in order." }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "type": "boolean", "nullable": true, "description": "Whether the entire concat should be preserved as-is (i.e., not tokenized). If this is\nset, any descendant subparts cannot contain any preserve-related fields set." }, "mask": { "type": "boolean", "nullable": true, "description": "Whether the entire concat should be masked when doing masked decryption. If this is\nset, any descendant subparts cannot contain any mask-related fields set." }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The maximum allowed length for this part (in chars)." } }, "required": [ "concat" ] } ] }, "FpeCompoundPartMultiple": { "allOf": [ { "type": "object", "description": "Indicates a part that is possibly repeated multiple times.\n\nImplementation note: the backend parser is locally \"greedy\" and will attempt to match\nas many repetitions as possible. If this later results in an invalid parse of the rest\nof the input, the backend ***will not backtrack*** and will simply return with an error.", "properties": { "multiple": { "$ref": "#/components/schemas/FpeDataPart" }, "min_repetitions": { "type": "integer", "nullable": true, "description": "The minimum number of times the subpart may occur. (A value of 1 marks a single\noccurrence.)" }, "max_repetitions": { "type": "integer", "nullable": true, "description": "The maximum number of times the subpart may occur. (A value of 1 marks a single\noccurrence.)" }, "constraints": { "$ref": "#/components/schemas/FpeConstraints" }, "preserve": { "type": "boolean", "nullable": true, "description": "Whether the entire Multiple should be preserved as-is (i.e., not tokenized). If this\nis set, the `multiple` subpart and its descendants cannot contain any preserve-related\nfields set." }, "mask": { "type": "boolean", "nullable": true, "description": "Whether the entire Multiple should be masked when doing masked decryption. If this is\nset, the `multiple` subpart and its descendants cannot contain any mask-related fields\nset." }, "min_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The minimum allowed length for this part (in chars)." }, "max_length": { "type": "integer", "minimum": 0, "maximum": 4294967295, "nullable": true, "description": "The maximum allowed length for this part (in chars)." } }, "required": [ "multiple" ] } ] }, "FpeSection": { "allOf": [ { "type": "object", "description": "A concatenation of groups, optionally including a checksum.", "properties": { "groups": { "type": "array", "items": { "$ref": "#/components/schemas/FpeGroup" } }, "checksum": { "$ref": "#/components/schemas/FpeChecksum" } }, "required": [ "groups" ] } ] }, "MgfPolicyMgf1": { "allOf": [ { "type": "object", "properties": { "hash": { "$ref": "#/components/schemas/DigestAlgorithm" } } } ] }, "FpeDateConstraint": { "description": "Possible date-related constraint types for a portion of a complex tokenization data type.", "oneOf": [ { "$ref": "#/components/schemas/FpeDate" }, { "$ref": "#/components/schemas/FpeDatePart" } ] }, "FpeConstraintsApplicability": { "description": "A structure indicating which subparts to which to apply a set of constraints.", "oneOf": [ { "$ref": "#/components/schemas/All" }, { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/FpeConstraintsApplicability" }, "description": "An object representing the individual subparts that the constraints should apply to. This\nis a BTreeMap where for each key-value pair, the key represents the \"index\" of the subpart\n(with the first subpart having index 0), and the value is an FpeConstraintsApplicability\ninstance. Note that a Multiple part only allows for one possible key-value pair, since it\nonly contains one subpart. For Concat parts, the key is the zero-based index of the subpart\nin the `concat` field, and for Multiple parts, this is always 0 (due to a Multiple having\nonly one subpart).\n\nThis cannot be used with OR parts; instead, specify constraints individually on each\nrelevant subpart." } ] }, "All": { "description": "A helper enum with a single variant, All, which indicates that something should apply to an\nentire part. (This is here mainly to allow other untagged enums to work properly.)", "type": "string", "enum": [ "all" ] }, "FpeGroup": { "allOf": [ { "type": "object", "description": "A concatenation of codes, that can be repeated an amount of times. An\namount of leading and trailing characters can be preserved, this is,\nunmodified by tokenization.", "properties": { "codes": { "type": "array", "items": { "$ref": "#/components/schemas/FpeCode" } }, "min_repetitions": { "type": "integer", "nullable": true, "description": "A group cannot be omitted, thus this field must be positive if present." }, "max_repetitions": { "type": "integer", "nullable": true }, "preserve": { "type": "array", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "nullable": true, "description": "Amount of leading and trailing characters to preserve in this group.\nPreserved characters are the leading/trailing characters of the whole\ngroup, not individual repetitions." } }, "required": [ "codes" ] } ] }, "FpeChecksum": { "type": "string", "enum": [ "luhn" ] }, "DigestAlgorithm": { "description": "A hash algorithm.", "type": "string", "enum": [ "BLAKE2B256", "BLAKE2B384", "BLAKE2B512", "BLAKE2S256", "RIPEMD160", "SSL3", "SHA1", "SHA224", "SHA256", "SHA384", "SHA512", "STREEBOG256", "STREEBOG512", "SHA3_224", "SHA3_256", "SHA3_384", "SHA3_512" ] }, "FpeDate": { "description": "A structure for specifying a token part representing a date that occurs after a specified date\nand/or occurs before a specified date. Depending on the subparts that make up the date, one of\nthe three options is used.", "oneOf": [ { "title": "FpeDateVariantDayMonthYear", "type": "object", "properties": { "dmy_date": { "$ref": "#/components/schemas/FpeDateDayMonthYear" } }, "required": [ "dmy_date" ] }, { "title": "FpeDateVariantMonthDay", "type": "object", "properties": { "month_day_date": { "$ref": "#/components/schemas/FpeDateMonthDay" } }, "required": [ "month_day_date" ] }, { "title": "FpeDateVariantMonthYear", "type": "object", "properties": { "month_year_date": { "$ref": "#/components/schemas/FpeDateMonthYear" } }, "required": [ "month_year_date" ] } ] }, "FpeDatePart": { "description": "Possible date-related constraint types that do not form a complete date (by themselves) for a\ncomplex tokenization data type.", "type": "string", "enum": [ "month", "day", "year" ] }, "FpeCode": { "allOf": [ { "type": "object", "description": "A set of words, repeated an amount of times.", "properties": { "words": { "$ref": "#/components/schemas/FpeWords" }, "min_repetitions": { "type": "integer", "nullable": true }, "max_repetitions": { "type": "integer", "nullable": true } }, "required": [ "words" ] } ] }, "FpeDateDayMonthYear": { "allOf": [ { "type": "object", "description": "Represents a date that consists of a Month subpart, a Day subpart, and a Year subpart. The\nYear part is allowed to be preserved, and the Day and Month parts are allowed to be\npreserved together. (The Day part cannot be preserved if the Month part is not, and vice\nversa.)", "properties": { "before": { "$ref": "#/components/schemas/FpeDayMonthYearDate" }, "after": { "$ref": "#/components/schemas/FpeDayMonthYearDate" } } } ] }, "FpeDateMonthDay": { "allOf": [ { "type": "object", "description": "Represents a date that consists of a Month subpart and a Day subpart. It is an error to\npreserve only the Month part or the Day part.", "properties": { "before": { "$ref": "#/components/schemas/FpeDayMonthDate" }, "after": { "$ref": "#/components/schemas/FpeDayMonthDate" } } } ] }, "FpeDateMonthYear": { "allOf": [ { "type": "object", "description": "Represents a date that consists of a Month subpart and a Year subpart. The Year part is\nallowed to be preserved; however, the Month part cannot be preserved by itself.", "properties": { "before": { "$ref": "#/components/schemas/FpeMonthYearDate" }, "after": { "$ref": "#/components/schemas/FpeMonthYearDate" } } } ] }, "FpeWords": { "description": "A set of fixed-length strings.", "oneOf": [ { "title": "FpeWordsVariantIntegerRanges", "type": "object", "properties": { "integer_ranges": { "$ref": "#/components/schemas/FpeWordsIntegerRanges" } }, "required": [ "integer_ranges" ] }, { "title": "FpeWordsVariantAlphabet", "type": "object", "properties": { "alphabet": { "$ref": "#/components/schemas/FpeCharSet" } }, "required": [ "alphabet" ] }, { "title": "FpeWordsVariantCustom", "type": "object", "properties": { "custom": { "$ref": "#/components/schemas/FpeWordsCustom" } }, "required": [ "custom" ] } ] }, "FpeDayMonthYearDate": { "allOf": [ { "type": "object", "description": "A structure for specifying a particular date consisting of a day, month, and year, for use in\nan FpeDate structure.", "properties": { "year": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The year, which should be an integer less than 100000. Zero is treated as a leap year." }, "month": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The month, which should be an integer from 1 to 12." }, "day": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The day, which should be an integer from 1 to either 28, 29, 30, or 31, depending on the\nmonth and year." } }, "required": [ "year", "month", "day" ] } ] }, "FpeDayMonthDate": { "allOf": [ { "type": "object", "description": "A structure for specifying a particular date consisting of a day and a month, for use in an\nFpeDate structure.", "properties": { "month": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The month, which should be an integer from 1 to 12." }, "day": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The day, which should be an integer from 1 to either 29, 30, or 31, depending on the month\nand year. Here, February is treated as having 29 days." } }, "required": [ "month", "day" ] } ] }, "FpeMonthYearDate": { "allOf": [ { "type": "object", "description": "A structure for specifying a particular date consisting of a month and a year, for use in an\nFpeDate structure.", "properties": { "year": { "type": "integer", "minimum": 0, "maximum": 4294967295, "description": "The year, which should be an integer less than 100000. Zero is treated as a leap year." }, "month": { "type": "integer", "minimum": 0, "maximum": 255, "description": "The month, which should be an integer from 1 to 12." } }, "required": [ "year", "month" ] } ] }, "FpeWordsIntegerRanges": { "allOf": [ { "type": "object", "description": "A union of positive integer ranges.\n\n```plain\nExamples: [[0, 400], [402, 1000]]\n= {0000, 0001, ..., 0400, 0402, ..., 1000}\n\n[[1,3], [49, 50]] with optional padding of length 8\n= {00000001, 00000002, 00000003, 00000049, 00000050}\n(accepts 1, 01, 00002, 49, 000050, etc)\n```", "properties": { "ranges": { "type": "array", "items": { "type": "array", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2 } }, "padding_required": { "type": "boolean", "description": "If this field is true, this set accepts only numeric strings\npadded to the length given by the maximum integer in the range\nset." } }, "required": [ "ranges", "padding_required" ] } ] }, "FpeWordsCustom": { "allOf": [ { "type": "object", "properties": { "list": { "type": "array", "items": { "type": "string" }, "description": "Examples: {\"john\", \"jane\"}, {\".\", \"-\", \"_\", \"@\", \" \"}" } }, "required": [ "list" ] } ] } } } } ````