{"openapi":"3.1.0","info":{"title":"Certificate Authority Manager API","version":"1.0.0","description":"REST API for managing mTLS Certificate Authority operations including CA initialization, certificate issuance, revocation, renewal, and monitoring for the SwePay payment gateway."},"servers":[{"url":"https://ca.swepay.com.br","description":"API Gateway"}],"paths":{"/v1/ca/initialize":{"post":{"operationId":"InitializeCA","summary":"Initialize Certificate Authority","description":"Creates and initializes a new root Certificate Authority for the authenticated tenant. Generates a self-signed CA certificate and stores the private key securely in AWS Secrets Manager.","x-swepay-errors":["VALIDATION_FAILED","CERTIFICATE_LIMIT_REACHED"],"tags":["Certificate Authority"],"security":[{"JwtBearer":[]}],"requestBody":{"required":"true","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitializeCARequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InitializeCACommandResponse"}}}},"400":{"description":"Bad Request","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"409":{"description":"Conflict","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v1/certificates":{"get":{"operationId":"ListCertificates","summary":"List all certificates","description":"Returns a list of all certificates issued for the authenticated tenant, including their status, serial number, and expiration details.","tags":["Certificates"],"security":[{"JwtBearer":[]}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCertificatesQueryResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}},"post":{"operationId":"CreateCertificate","summary":"Issue a new client certificate","description":"Issues a new X.509 client certificate signed by the tenant\u0027s root CA. The certificate includes CRL Distribution Points and Authority Information Access extensions.","x-swepay-errors":["VALIDATION_FAILED","NOT_FOUND"],"tags":["Certificates"],"security":[{"JwtBearer":[]}],"requestBody":{"required":"true","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCertificateRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCertificateCommandResponse"}}}},"400":{"description":"Bad Request","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"404":{"description":"Not Found","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v1/certificates/{certificateId}":{"get":{"operationId":"GetCertificate","summary":"Get certificate by ID","description":"Returns the full details of a specific certificate, including the PEM-encoded certificate, status, issuance and expiration dates, and revocation information if applicable.","tags":["Certificates"],"security":[{"JwtBearer":[]}],"parameters":[{"name":"certificateId","in":"path","required":"true","schema":{"type":"string"}}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetCertificateQueryResponse"}}}},"404":{"description":"Not Found","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v1/certificates/{certificateId}/renew":{"post":{"operationId":"RenewCertificate","summary":"Renew a certificate","description":"Renews an existing certificate by issuing a new one with the same attributes but a new validity period. The original certificate remains valid until its natural expiration.","x-swepay-errors":["VALIDATION_FAILED","NOT_FOUND"],"tags":["Certificates"],"security":[{"JwtBearer":[]}],"parameters":[{"name":"certificateId","in":"path","required":"true","schema":{"type":"string"}}],"requestBody":{"required":"true","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenewCertificateRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenewCertificateCommandResponse"}}}},"400":{"description":"Bad Request","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"404":{"description":"Not Found","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v1/certificates/{certificateId}/revoke":{"post":{"operationId":"RevokeCertificate","summary":"Revoke a certificate","description":"Revokes a previously issued certificate with the specified reason. The certificate will be added to the Certificate Revocation List (CRL) and will no longer be considered valid.","x-swepay-errors":["VALIDATION_FAILED","NOT_FOUND"],"tags":["Certificates"],"security":[{"JwtBearer":[]}],"parameters":[{"name":"certificateId","in":"path","required":"true","schema":{"type":"string"}}],"requestBody":{"required":"true","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeCertificateRequest"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeCertificateCommandResponse"}}}},"400":{"description":"Bad Request","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"404":{"description":"Not Found","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v1/certificates/expiring":{"get":{"operationId":"GetExpiringCertificates","summary":"Get expiring certificates for the authenticated tenant","description":"Returns certificates for the authenticated tenant expiring within the specified number of days. Query parameter \u0027days\u0027 defaults to 30.","tags":["Certificates"],"security":[{"JwtBearer":[]}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetExpiringCertificatesQueryResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v2/certificates":{"post":{"operationId":"CreateCertificateV2","summary":"Issue a client certificate with custom extensions","description":"Issues a new X.509 client certificate with optional custom key-value extensions embedded as individual OID extensions (1.3.6.1.4.1.99999.2.{n}). Maximum 10 custom extensions, each key and value up to 255 characters.","x-swepay-errors":["VALIDATION_FAILED","NOT_FOUND"],"tags":["Certificates"],"security":[{"JwtBearer":[]}],"requestBody":{"required":"true","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCertificateV2Request"},"examples":{"client_cert":{"summary":"mTLS client auth (sem SAN, usage Client)","value":{"clientId":"api-gateway-prod","commonName":"api.tenant.com.br","organization":"Tenant Corp","organizationalUnit":"Payments","country":"BR","validityDays":"365","usage":"Client","responseFormat":"Text","passwordProtected":"false","mustStaple":"false"}},"server_cert":{"summary":"TLS server (SAN \u002B mustStaple, responseFormat File)","value":{"clientId":"payment-gw-prod","commonName":"api.tenant.com.br","organization":"Tenant Corp","organizationalUnit":"Payments","country":"BR","validityDays":"365","usage":"Server","subjectAlternativeNames":["api.tenant.com.br","*.api.tenant.com.br"],"mustStaple":"true","responseFormat":"File","passwordProtected":"false"}},"client_and_server":{"summary":"mTLS bidirecional (ambos EKUs, SAN obrigat\u00F3rio)","value":{"clientId":"bidirectional-gw","commonName":"gw.tenant.com.br","organization":"Tenant Corp","organizationalUnit":"Infrastructure","country":"BR","validityDays":"365","usage":"ClientAndServer","subjectAlternativeNames":["gw.tenant.com.br"],"mustStaple":"false","responseFormat":"Text","passwordProtected":"true"}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCertificateCommandResponse"}}}},"400":{"description":"Bad Request","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"404":{"description":"Not Found","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}},"/v2/certificates/{certificateId}/renew":{"post":{"operationId":"RenewCertificateV2","summary":"Renew a certificate preserving custom extensions","description":"Renews an existing certificate preserving all custom X.509 extensions from the original certificate. The ClientId and all custom key-value extensions are copied to the new certificate.","x-swepay-errors":["VALIDATION_FAILED","NOT_FOUND"],"tags":["Certificates"],"security":[{"JwtBearer":[]}],"parameters":[{"name":"certificateId","in":"path","required":"true","schema":{"type":"string"}}],"requestBody":{"required":"true","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenewCertificateV2Request"}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenewCertificateCommandResponse"}}}},"400":{"description":"Bad Request","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"404":{"description":"Not Found","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"500":{"$ref":"#/components/responses/InternalServerError"}}}}},"components":{"schemas":{"ProblemDetails":{"type":"object","description":"RFC 7807 Problem Details object returned for all domain-level errors. Content-Type is \u0060application/problem\u002Bjson\u0060.\n","required":["type","title","status","detail"],"properties":{"type":{"type":"string","format":"uri","description":"A URI reference that identifies the problem type. Points at the Swepay error catalog \u0060https://errors.swepay.com.br/{common|ca-manager}/{slug}\u0060.\n","example":"https://errors.swepay.com.br/common/not-found"},"title":{"type":"string","description":"A short, human-readable summary of the problem type.","example":"Not Found"},"status":{"type":"integer","format":"int32","description":"The HTTP status code for this occurrence of the problem.","example":"404"},"detail":{"type":"string","description":"A human-readable explanation specific to this occurrence of the problem.\n","example":"The certificate with the specified ID was not found."}}},"ValidationProblemDetails":{"allOf":[{"$ref":"#/components/schemas/ProblemDetails"},{"type":"object","required":["errors"],"properties":{"errors":{"type":"array","description":"List of field-level validation failures. Present only on 400 responses; omitted on 401, 403, 404, 409, and 500.\n","items":{"$ref":"#/components/schemas/ValidationError"}}}}],"example":{"type":"https://errors.swepay.com.br/common/validation-failed","title":"Validation Failed","status":"400","detail":"One or more validation errors occurred. See \u0027errors\u0027 for details.","errors":[{"field":"validityDays","message":"Must be greater than 0"}]}},"ValidationError":{"type":"object","description":"A single field-level validation failure within a 400 response.","required":["field","message"],"properties":{"field":{"type":"string","description":"The name of the request field that failed validation.","example":"validityDays"},"message":{"type":"string","description":"A human-readable description of the validation failure.","example":"Must be greater than 0"}}},"InitializeCAResponse":{"type":"object","properties":{"tenantId":{"type":"string","format":"uuid","description":"The tenant ID"},"caCertificateId":{"type":"string","format":"uuid","description":"The generated CA certificate ID"},"message":{"type":"string","description":"Success message"}}},"CreateCertificateResponse":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid","description":"The generated certificate ID"},"thumbprint":{"type":"string","description":"Certificate thumbprint (SHA-256)"},"serialNumber":{"type":"string","description":"Certificate serial number"},"expiresAt":{"type":"string","format":"date-time","description":"Certificate expiration date"}}},"RevokeCertificateResponse":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"status":{"type":"string","example":"Revoked"},"revokedAt":{"type":"string","format":"date-time"}}},"RenewCertificateResponse":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"newThumbprint":{"type":"string"},"newSerialNumber":{"type":"string"},"expiresAt":{"type":"string","format":"date-time"}}},"CertificateDetail":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"tenantId":{"type":"string","format":"uuid"},"commonName":{"type":"string"},"thumbprint":{"type":"string"},"serialNumber":{"type":"string"},"status":{"type":"string","enum":["Active","Revoked","Expired"]},"issuedAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"revokedAt":{"type":"string","format":"date-time","nullable":"true"}}},"CertificateSummary":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"clientId":{"type":"string"},"commonName":{"type":"string"},"serialNumber":{"type":"string"},"status":{"type":"string","enum":["Active","Revoked","Expired"],"x-enum-descriptions":["Certificado ativo e v\u00E1lido","Certificado revogado \u2014 consta na CRL e respostas OCSP","Certificado expirado naturalmente (notAfter ultrapassado)"],"x-enum-varnames":["ACTIVE","REVOKED","EXPIRED"]},"issuedAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"daysUntilExpiration":{"type":"integer","format":"int32"}},"required":["certificateId","clientId","commonName","serialNumber","status","issuedAt","expiresAt","daysUntilExpiration"]},"CreateCertificateCommandResponse":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid","description":"Identificador \u00FAnico do certificado no CA Manager.","example":"3fa85f64-5717-4562-b3fc-2c963f66afa6"},"serialNumber":{"type":"string","description":"N\u00FAmero de s\u00E9rie do certificado X.509 \u2014 \u00FAnico por CA. Usado em consultas OCSP e entradas da CRL.","example":"7F4A2E9B1C3D5E0F"},"certificatePem":{"type":"string","description":"Certificado X.509 codificado em PEM (presente quando ResponseFormat=Text)."},"privateKeyPem":{"type":"string","description":"Chave privada codificada em PEM (presente quando ResponseFormat=Text). Retornada uma \u00FAnica vez \u2014 n\u00E3o \u00E9 armazenada pelo CA Manager."},"expiresAt":{"type":"string","format":"date-time","description":"Data e hora UTC de expira\u00E7\u00E3o do certificado.","example":"2026-06-03T00:00:00Z"},"certificateDownloadUrl":{"type":"string","description":"URL S3 pr\u00E9-assinada para download do certificado PEM (presente quando ResponseFormat=File). TTL 1 hora.","example":"https://s3.sa-east-1.amazonaws.com/..."},"privateKeyDownloadUrl":{"type":"string","description":"URL S3 pr\u00E9-assinada para download da chave privada PEM (presente quando ResponseFormat=File). TTL 1 hora.","example":"https://s3.sa-east-1.amazonaws.com/..."},"downloadUrlExpiresAt":{"type":"string","format":"date-time","description":"Data e hora UTC de expira\u00E7\u00E3o das URLs pr\u00E9-assinadas S3 (presente quando ResponseFormat=File).","example":"2026-06-03T01:00:00Z"},"pfxBase64":{"type":"string","description":"Certificado e chave privada empacotados como PKCS#12 em Base64 (presente quando PasswordProtected=true e ResponseFormat=Text)."},"password":{"type":"string","description":"Senha do arquivo PKCS#12 (presente quando PasswordProtected=true). Retornada uma \u00FAnica vez \u2014 n\u00E3o \u00E9 armazenada pelo CA Manager."},"pfxDownloadUrl":{"type":"string","description":"URL S3 pr\u00E9-assinada para download do arquivo PKCS#12 (presente quando PasswordProtected=true e ResponseFormat=File). TTL 1 hora.","example":"https://s3.sa-east-1.amazonaws.com/..."}},"required":["certificateId","serialNumber","expiresAt"]},"CreateCertificateRequest":{"type":"object","properties":{"clientId":{"type":"string","description":"Identificador \u00FAnico do cliente OAuth2 / sistema que usar\u00E1 o certificado para autentica\u00E7\u00E3o mTLS.","example":"api-gateway-prod","minLength":"1","maxLength":"100"},"commonName":{"type":"string","description":"Common Name (CN) do Subject do certificado X.509.","example":"api.tenant.com.br","minLength":"1","maxLength":"64"},"organization":{"type":"string","description":"Nome da organiza\u00E7\u00E3o (O) do Subject.","example":"Tenant Corp","minLength":"1","maxLength":"64"},"organizationalUnit":{"type":"string","description":"Unidade organizacional (OU) do Subject.","example":"Payments","minLength":"1","maxLength":"64"},"country":{"type":"string","description":"Pa\u00EDs (C) do Subject \u2014 c\u00F3digo ISO 3166-1 alpha-2 de dois caracteres.","example":"BR","minLength":"2","maxLength":"2","pattern":"^[A-Z]{2}$"},"validityDays":{"type":"integer","format":"int32","description":"Validade do certificado em dias.","example":"365","minimum":"1","maximum":"3650"},"responseFormat":{"type":"string","enum":["Text","File"],"description":"Formato da resposta: Text retorna PEM inline; File retorna URLs S3 pr\u00E9-assinadas com TTL 1h.","example":"Text","x-enum-descriptions":["PEM inline na resposta (certificatePem \u002B privateKeyPem)","URLs S3 pr\u00E9-assinadas (TTL 1h) \u2014 certificateDownloadUrl \u002B privateKeyDownloadUrl"],"x-enum-varnames":["TEXT","FILE"]},"passwordProtected":{"type":"boolean","description":"Quando true, gera um PKCS#12 protegido por senha aleat\u00F3ria retornada uma \u00FAnica vez na resposta."}},"required":["clientId","commonName","organization","organizationalUnit","country","validityDays"]},"CreateCertificateV2Request":{"type":"object","properties":{"clientId":{"type":"string","description":"Identificador \u00FAnico do cliente OAuth2 / sistema que usar\u00E1 o certificado para autentica\u00E7\u00E3o mTLS. Deve corresponder ao client_id configurado no gateway.","example":"api-gateway-prod","minLength":"1","maxLength":"100"},"commonName":{"type":"string","description":"Common Name (CN) do Subject do certificado X.509. Geralmente o hostname ou identificador do sistema.","example":"api.tenant.com.br","minLength":"1","maxLength":"64"},"organization":{"type":"string","description":"Nome da organiza\u00E7\u00E3o (O) do Subject \u2014 entidade legal detentora do certificado.","example":"Tenant Corp","minLength":"1","maxLength":"64"},"organizationalUnit":{"type":"string","description":"Unidade organizacional (OU) do Subject \u2014 departamento ou fun\u00E7\u00E3o.","example":"Payments","minLength":"1","maxLength":"64"},"country":{"type":"string","description":"Pa\u00EDs (C) do Subject \u2014 c\u00F3digo ISO 3166-1 alpha-2 de dois caracteres.","example":"BR","minLength":"2","maxLength":"2","pattern":"^[A-Z]{2}$"},"validityDays":{"type":"integer","format":"int32","description":"Validade do certificado em dias. M\u00E1ximo 825 dias para usage Server e ClientAndServer (CA/Browser Forum Baseline Requirements).","example":"365","minimum":"1","maximum":"3650"},"customExtensions":{"type":"object","description":"Extens\u00F5es X.509 customizadas embutidas como OIDs individuais (1.3.6.1.4.1.99999.2.{n}). M\u00E1ximo 10 extens\u00F5es; chave e valor at\u00E9 255 caracteres cada.","additionalProperties":"true","x-additionalPropertiesName":"ExtensionValue"},"responseFormat":{"type":"string","enum":["Text","File"],"description":"Formato da resposta: Text retorna PEM inline; File retorna URLs S3 pr\u00E9-assinadas com TTL 1h.","example":"Text","x-enum-descriptions":["PEM inline na resposta (certificatePem \u002B privateKeyPem)","URLs S3 pr\u00E9-assinadas (TTL 1h) \u2014 certificateDownloadUrl \u002B privateKeyDownloadUrl"],"x-enum-varnames":["TEXT","FILE"]},"passwordProtected":{"type":"boolean","description":"Quando true, o certificado e a chave privada s\u00E3o empacotados como PKCS#12 protegido por senha aleat\u00F3ria. A senha \u00E9 retornada uma \u00FAnica vez na resposta."},"usage":{"type":"string","enum":["Client","Server","ClientAndServer"],"description":"Define os EKUs (Extended Key Usage) embutidos no certificado: Client (mTLS clientAuth), Server (serverAuth \u002B SAN obrigat\u00F3rio), ClientAndServer (ambos).","example":"Client","x-enum-descriptions":["mTLS client auth (EKU clientAuth 1.3.6.1.5.5.7.3.2) \u2014 tenant\u2192gateway","TLS server (EKU serverAuth 1.3.6.1.5.5.7.3.1) \u2014 requer SAN; validade m\u00E1x 825 dias","mTLS bidirecional (ambos EKUs clientAuth \u002B serverAuth) \u2014 requer SAN; validade m\u00E1x 825 dias"],"x-enum-varnames":["CLIENT","SERVER","CLIENT_AND_SERVER"]},"subjectAlternativeNames":{"type":"array","items":{"type":"string"},"description":"Lista de Subject Alternative Names (RFC 5280 \u00A74.2.1.6). Obrigat\u00F3rio para usage Server e ClientAndServer. Aceita DNS names e wildcards de um n\u00EDvel (*.api.tenant.com.br); rejeita IPs e wildcards multin\u00EDvel. M\u00E1ximo 50 entradas.","maxItems":"50"},"mustStaple":{"type":"boolean","description":"RFC 7633 TLS Feature extension (OID 1.3.6.1.5.5.7.1.24) \u2014 for\u00E7a OCSP stapling no cliente TLS. Aplic\u00E1vel apenas para usage Server e ClientAndServer."}},"required":["clientId","commonName","organization","organizationalUnit","country","validityDays"]},"ExpiringCertificateSummary":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"tenantId":{"type":"string","format":"uuid"},"clientId":{"type":"string"},"commonName":{"type":"string"},"serialNumber":{"type":"string"},"status":{"type":"string","enum":["Active","Revoked","Expired"],"x-enum-descriptions":["Certificado ativo e v\u00E1lido","Certificado revogado \u2014 consta na CRL e respostas OCSP","Certificado expirado naturalmente (notAfter ultrapassado)"],"x-enum-varnames":["ACTIVE","REVOKED","EXPIRED"]},"expiresAt":{"type":"string","format":"date-time"},"daysUntilExpiration":{"type":"integer","format":"int32"}},"required":["certificateId","tenantId","clientId","commonName","serialNumber","status","expiresAt","daysUntilExpiration"]},"GetCertificateQuery":{"type":"object","properties":{"tenantId":{"type":"string","format":"uuid"},"certificateId":{"type":"string","format":"uuid"}},"required":["tenantId","certificateId"]},"GetCertificateQueryResponse":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"tenantId":{"type":"string","format":"uuid"},"clientId":{"type":"string"},"commonName":{"type":"string"},"serialNumber":{"type":"string"},"certificatePem":{"type":"string"},"status":{"type":"string","enum":["Active","Revoked","Expired"],"x-enum-descriptions":["Certificado ativo e v\u00E1lido","Certificado revogado \u2014 consta na CRL e respostas OCSP","Certificado expirado naturalmente (notAfter ultrapassado)"],"x-enum-varnames":["ACTIVE","REVOKED","EXPIRED"]},"issuedAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"revokedAt":{"type":"string","format":"date-time"},"revocationReason":{"type":"string"},"daysUntilExpiration":{"type":"integer","format":"int32"}},"required":["certificateId","tenantId","clientId","commonName","serialNumber","certificatePem","status","issuedAt","expiresAt","daysUntilExpiration"]},"GetExpiringCertificatesQuery":{"type":"object","properties":{"daysUntilExpiration":{"type":"integer","format":"int32"},"tenantFilter":{"type":"string","format":"uuid"}},"required":["daysUntilExpiration"]},"GetExpiringCertificatesQueryResponse":{"type":"object","properties":{"certificates":{"type":"array","items":{"$ref":"#/components/schemas/ExpiringCertificateSummary"}}},"required":["certificates"]},"InitializeCACommandResponse":{"type":"object","properties":{"caId":{"type":"string","format":"uuid"},"certificatePem":{"type":"string"},"expiresAt":{"type":"string","format":"date-time"}},"required":["caId","certificatePem","expiresAt"]},"InitializeCARequest":{"type":"object","properties":{"commonName":{"type":"string","description":"Common Name (CN) da CA raiz do tenant \u2014 geralmente o nome da organiza\u00E7\u00E3o ou dom\u00EDnio.","example":"Tenant Corp Root CA","minLength":"1","maxLength":"64"},"organization":{"type":"string","description":"Nome da organiza\u00E7\u00E3o (O) do Subject da CA.","example":"Tenant Corp","minLength":"1","maxLength":"64"},"country":{"type":"string","description":"Pa\u00EDs (C) do Subject \u2014 c\u00F3digo ISO 3166-1 alpha-2 de dois caracteres.","example":"BR","minLength":"2","maxLength":"2","pattern":"^[A-Z]{2}$"},"validityYears":{"type":"integer","format":"int32","description":"Validade da CA em anos. Certificados emitidos n\u00E3o podem ultrapassar a data de expira\u00E7\u00E3o da CA.","example":"10","minimum":"1","maximum":"30"}},"required":["commonName","organization","country","validityYears"]},"ListCertificatesQuery":{"type":"object","properties":{"tenantId":{"type":"string","format":"uuid"}},"required":["tenantId"]},"ListCertificatesQueryResponse":{"type":"object","properties":{"certificates":{"type":"array","items":{"$ref":"#/components/schemas/CertificateSummary"}}},"required":["certificates"]},"RenewCertificateCommandResponse":{"type":"object","properties":{"newCertificateId":{"type":"string","format":"uuid"},"serialNumber":{"type":"string"},"certificatePem":{"type":"string"},"privateKeyPem":{"type":"string"},"expiresAt":{"type":"string","format":"date-time"},"certificateDownloadUrl":{"type":"string"},"privateKeyDownloadUrl":{"type":"string"},"downloadUrlExpiresAt":{"type":"string","format":"date-time"},"pfxBase64":{"type":"string"},"password":{"type":"string"},"pfxDownloadUrl":{"type":"string"}},"required":["newCertificateId","serialNumber","expiresAt"]},"RenewCertificateRequest":{"type":"object","properties":{"validityDays":{"type":"integer","format":"int32","description":"Nova validade do certificado renovado em dias. O certificado original permanece v\u00E1lido at\u00E9 expirar naturalmente.","example":"365","minimum":"1","maximum":"3650"},"responseFormat":{"type":"string","enum":["Text","File"],"description":"Formato da resposta: Text retorna PEM inline; File retorna URLs S3 pr\u00E9-assinadas com TTL 1h.","example":"Text","x-enum-descriptions":["PEM inline na resposta (certificatePem \u002B privateKeyPem)","URLs S3 pr\u00E9-assinadas (TTL 1h) \u2014 certificateDownloadUrl \u002B privateKeyDownloadUrl"],"x-enum-varnames":["TEXT","FILE"]},"passwordProtected":{"type":"boolean","description":"Quando true, gera um PKCS#12 protegido por senha aleat\u00F3ria retornada uma \u00FAnica vez na resposta."}},"required":["validityDays"]},"RenewCertificateV2Request":{"type":"object","properties":{"validityDays":{"type":"integer","format":"int32","description":"Nova validade do certificado renovado em dias. As extens\u00F5es customizadas do certificado original s\u00E3o preservadas automaticamente.","example":"365","minimum":"1","maximum":"3650"},"responseFormat":{"type":"string","enum":["Text","File"],"description":"Formato da resposta: Text retorna PEM inline; File retorna URLs S3 pr\u00E9-assinadas com TTL 1h.","example":"Text","x-enum-descriptions":["PEM inline na resposta (certificatePem \u002B privateKeyPem)","URLs S3 pr\u00E9-assinadas (TTL 1h) \u2014 certificateDownloadUrl \u002B privateKeyDownloadUrl"],"x-enum-varnames":["TEXT","FILE"]},"passwordProtected":{"type":"boolean","description":"Quando true, gera um PKCS#12 protegido por senha aleat\u00F3ria retornada uma \u00FAnica vez na resposta."}},"required":["validityDays"]},"RevokeCertificateCommandResponse":{"type":"object","properties":{"certificateId":{"type":"string","format":"uuid"},"revokedAt":{"type":"string","format":"date-time"}},"required":["certificateId","revokedAt"]},"RevokeCertificateRequest":{"type":"object","properties":{"reason":{"type":"string","description":"Descri\u00E7\u00E3o livre da raz\u00E3o de revoga\u00E7\u00E3o para o log de auditoria. N\u00E3o \u00E9 exposta na CRL nem em respostas OCSP.","example":"Chave privada comprometida \u2014 rota\u00E7\u00E3o emergencial","minLength":"1","maxLength":"255"},"reasonCode":{"type":"string","enum":["Unspecified","KeyCompromise","CaCompromise","AffiliationChanged","Superseded","CessationOfOperation","CertificateHold","RemoveFromCrl","PrivilegeWithdrawn","AaCompromise"],"description":"C\u00F3digo de raz\u00E3o RFC 5280 \u00A75.3.1 (CRLReason) embutido na CRL e em respostas OCSP. Padr\u00E3o: Unspecified.","example":"KeyCompromise","x-enum-descriptions":["(0) Nenhuma raz\u00E3o espec\u00EDfica \u2014 padr\u00E3o quando n\u00E3o informado","(1) Chave privada comprometida ou suspeita de comprometimento","(2) Chave da CA emissora comprometida","(3) Afilia\u00E7\u00E3o do sujeito (Organiza\u00E7\u00E3o, OU) alterada","(4) Certificado substitu\u00EDdo por um mais recente (ex.: renova\u00E7\u00E3o)","(5) Entidade encerrou opera\u00E7\u00F5es","(6) Certificado em suspens\u00E3o tempor\u00E1ria \u2014 pode ser reativado","(8) Certificado removido da CRL (era hold, agora reativado)","(9) Privil\u00E9gios retirados \u2014 sujeito n\u00E3o tem mais os direitos concedidos","(10) Chave da autoridade de atributos (AA) comprometida"],"x-enum-varnames":["UNSPECIFIED","KEY_COMPROMISE","CA_COMPROMISE","AFFILIATION_CHANGED","SUPERSEDED","CESSATION_OF_OPERATION","CERTIFICATE_HOLD","REMOVE_FROM_CRL","PRIVILEGE_WITHDRAWN","AA_COMPROMISE"]}},"required":["reason"]},"SwepayProblemDetails":{"type":"object","description":"Swepay error payload (RFC 9457 superset). Carries a machine-readable code, UX-written recovery hint and request correlation id.","properties":{"type":{"type":"string","format":"uri","description":"Canonical documentation URL for this error class."},"title":{"type":"string","description":"Short, human-readable classification."},"status":{"type":"integer","format":"int32","description":"HTTP status code echoed into the body."},"detail":{"type":"string","description":"End-user message. Never contains stack traces or internal identifiers."},"instance":{"type":"string","description":"URI of the specific occurrence (usually the resource path)."},"code":{"type":"string","description":"Machine-readable error code from the Swepay catalog."},"recovery":{"type":"string","description":"Concrete next step the caller should take."},"requestId":{"type":"string","description":"Correlation id, echoed from X-Request-Id when supplied."}},"required":["type","title","status","detail","code","recovery","requestId"]}},"responses":{"Forbidden":{"description":"Insufficient permissions or tenant isolation violation (RFC 7807 Problem Details). Returned when a tenant attempts to access a resource belonging to another tenant, or when the tenant account is suspended.\n","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/ProblemDetails"},"example":{"type":"https://errors.swepay.com.br/common/forbidden","title":"Forbidden","status":"403","detail":"You do not have permission to access this resource."}}}},"NotFound":{"description":"The requested resource does not exist (RFC 7807 Problem Details). Distinct from 404-on-unknown-route, which is emitted by NativeLambdaRouter in \u0060application/json\u0060 format.\n","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/ProblemDetails"},"example":{"type":"https://errors.swepay.com.br/common/not-found","title":"Not Found","status":"404","detail":"The certificate with the specified ID was not found."}}}},"Conflict":{"description":"The request conflicts with the current state of the resource (RFC 7807 Problem Details). Returned when a CA already exists for the tenant, or when a certificate plan limit is reached (slug: \u0060certificate-limit-reached\u0060).\n","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/ProblemDetails"},"example":{"type":"https://errors.swepay.com.br/ca-manager/conflict","title":"Conflict","status":"409","detail":"A Certificate Authority already exists for this tenant."}}}},"BadRequest":{"description":"The request was invalid or malformed.","content":{"application/problem\u002Bjson":{"schema":{"$ref":"#/components/schemas/SwepayProblemDetails"}}}},"Unauthorized":{"description":"Authentication is required or the supplied credentials are invalid."},"InternalServerError":{"description":"An unexpected error occurred on the server."}},"securitySchemes":{"JwtBearer":{"type":"http","scheme":"bearer","bearerFormat":"JWT"}}}}