openapi: "3.0.2"
info:
  title: Krill RPKI Server API
  version: 0.8.0-dev
  description: |
    # Introduction
    Welcome to the documentation for the Krill server API, a JSON based
    REST-like API for managing your Krill Certificate Authorities and
    Publishers. For more information read the [Krill documentation](https://rpki.readthedocs.io/en/latest/krill/).

    ## Clients
    To interact with a Krill server using this API, either:
    - Use the [Krill CLI](https://rpki.readthedocs.io/en/latest/krill/using-cli.html).
    - Load this API specification into the Swagger [editor](https://editor.swagger.io/)
      or [viewer](https://petstore.swagger.io/) and use it to submit requests to
      a Krill server via your browser.
    - Use an [OpenAPI 3 generator](https://openapi-generator.tech/docs/generators.html)
      to generate client code based on this API specification.
    - Write your own client code that adheres to this specification.

    ## Versioning
    The API path includes a version. The idea is that we may add functionality,
    but will not introduce breaking changes to existing functionality. You may
    expect additional resources, and you may see additional data (JSON members)
    within resources. So, please make sure that you ignore any JSON members that
    you don’t support or need when using this API.

    ## References
    Information about many of the concepts and data types that Krill works with
    can be found in the following Internet standards documents:
    - [RFC 6492: A Protocol for Provisioning Resource Certificates](https://tools.ietf.org/html/rfc6492)
    - [RFC 8181: A Publication Protocol for the Resource Public Key Infrastructure (RPKI)](https://tools.ietf.org/html/rfc8181)
    - [RFC 8183: An Out-of-Band Setup Protocol for Resource Public Key Infrastructure (RPKI) Production Services](https://tools.ietf.org/html/rfc8183)

    ## Feedback
    Please give feedback and report issues concerning this API specification by
    creating a [Krill GitHub issue](https://github.com/NLnetLabs/krill/issues/new).

    # Authentication
    All Krill API endpoints are protected by [HTTP Bearer Authentication](https://swagger.io/docs/specification/authentication/bearer-authentication/).
    To use the endpoints the client must supply an HTTP Authorization header of the form:
    ```
    Authorization: Bearer <KRILL AUTH TOKEN>
    ```
    The token to use is defined in the Krill server configuration. Do not include
    the '<>' brackets in the request. For more information consult the [Krill documentation](https://rpki.readthedocs.io/en/latest/krill/running.html#admin-token).

    # Errors
    The format of and level of detail included in error reports from a Krill
    server depend on the type of failure that occured:
    - **5XX/Server Errors:** This type of failure occurs within or is caused
      by the environment in which Krill operates, or by bugs within Krill
      itself. Examples include network issues, resource starvation, access
      denied to resources, etc. Such errors are outside the control of Krill
      and may result in HTTP 5XX errors from a proxy in front of Krill or from
      Krill itself, or could manifest themselves as TCP timeouts and/or
      connection failures.
    - **4XX/Client Errors:** This type of failure occurs when the input
      provided to Krill is incorrect, either due to user error, adherence by
      the client to incorrect Krill API specifications, or malicious activity.
      Krill responds with HTTP 4XX errors, where possible with a HTTP response
      body in JSON format consisting of an error code and error message.
      **Note:** Clients should decide which action to take based on the error
      code, not on the error message. Such errors have the following form:
      ```
      {
          "label": "string",
          "msg": "string",
          "args": {
              "key1": "string",
              "key2": "string"
          }
      }
      ```

    Possible keys in the error response json are:
    ```
       "cause":      "The underlying error, usually a system error"
       "publisher":  "The handle of the publisher"
       "ca":         "The handle of the CA that encountered an error"
       "parent":     "The handle by which the CA knows a parent involved in an error"
       "child":      "The handle by which the CA knows its child involved in an error"
       "class_name": "The name of the RFC 6492 Resource Class involved in an error"
       "key_id":     "A Key Identifier for a key involved in an error"
       "prefix":     "The IPv4 or IPv6 prefix in a ROA"
       "asn":        "The ASN in a ROA"
       "max_length": "The max length (if present) for a ROA with issues"
    ```
  license:
    name: Mozilla Public License 2.0
    url: https://www.mozilla.org/en-US/MPL/2.0/
  x-logo:
    url: https://nlnetlabs.nl/static/logos/Krill/Krill_Logo_FC.svg
    backgroundColor: #FFFFFF

servers:
  - url: https://{domain}:{port}/api/v1
    description: Krill server API URL.
    variables:
      domain:
        default: localhost
      port:
        enum:
          - '443'
          - '3000'
        default: '3000'

tags:
  - name: "Publishers"
  - name: "Certificate Authorities"
  - name: "Key Rolls"
    description: |
      Krill CAs can have 0 or more 'Resource Classes' under each of its (0 or
      more) parents. Krill CAs will talk to all of their parents regularly and
      ask them about their resource entitlements. Typically a CA will have one
      parent and receive all their resources in a single resource class, but it's
      also possible that resources are split into multiple resource classes.
      Krill CAs can also have multiple parents and have resource classes under
      each of them.

      When a krill CA first gets a resource class it will:
      - create a pending key pair
      - request a certificate

      The 'key state' of this resource class is then shown as type "Pending".

      When the CA receives a certificate for this new pair it will be promoted to
      "Active", and publishing of objects will start. I.e. the CA will start
      publishing a manifest and CRL, and any configured ROAs for which the
      prefixes are held by this class.

      Resource classes in the state 'Active' can be rolled. The following phases
      exist in a key roll:
      - RollPending
      - RollNew
      - RollOld
  - name: "Route Authorizations"
    description: |
      Managing Route Authorizations (ROA configs)
  - name: "Other"

security:
  - KRILL_AUTH_TOKEN: []

paths:
  /authorized:
    get:
      operationId: is_authorized
      tags:
        - "Other"
      summary: Check if the client is authorized.
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'

  /publishers:
    get:
      operationId: list_publishers
      tags:
        - "Publishers"
      summary: List publishers.
      responses:
        '200':
          $ref: '#/components/responses/ListPublishers'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    post:
      operationId: add_publisher
      tags:
        - "Publishers"
      summary: Add publisher.
      description: |
        Adds an RFC 8181 publisher. Expects a JSON representation of the
        [RFC 8183 XML](https://tools.ietf.org/html/rfc8183#section-5.2.3).
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddPublisherRequest'
      responses:
        '200':
          $ref: '#/components/responses/AddPublisher'
        '400':
          $ref: '#/components/responses/PubDuplicateResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /publishers/{publisher_handle}:
    get:
      operationId: get_publisher
      tags:
        - "Publishers"
      summary: Get details for publisher.
      description: Gets the information for a publisher by a given handle.
      parameters:
        - $ref: '#/components/parameters/publisher_handle'
      responses:
        '200':
          $ref: '#/components/responses/GetPublisher'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/PubUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    delete:
      operationId: delete_publisher
      tags:
        - "Publishers"
      summary: Delete a publisher.
      description: This action also removes all the published content for a publisher.
      parameters:
        - $ref: '#/components/parameters/publisher_handle'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/PubUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /publishers/{publisher_handle}/response.{format}:
    get:
      operationId: get_publisher_repository_response
      tags:
        - "Publishers"
      summary: Get Repository Response for publisher.
      description: |
        Gets the [RFC 8183 Repository Response](https://tools.ietf.org/html/rfc8183#section-5.2.4)
        for a publisher.
      parameters:
        - $ref: '#/components/parameters/publisher_handle'
        - $ref: '#/components/parameters/format'
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Rfc8181'
            application/xml:
              schema:
                $ref: '#/components/schemas/RFC8183RepositoryResponseXML'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/PubUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /publishers/stale/{seconds}:
    get:
      operationId: list_publishers_stale_seconds
      tags:
        - "Publishers"
      summary: List all publishers which have not published for X seconds.
      description: |
        Lists all publishers which have not published for the given time (seconds). Typically one
        might expect updates from Krill publishers every 16 hours.
      parameters:
        - $ref: '#/components/parameters/seconds'
      responses:
        '200':
          $ref: '#/components/responses/StalePublishers'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas:
    get:
      operationId: list_cas
      tags:
        - "Certificate Authorities"
      summary: List CAs.
      responses:
        '200':
          $ref: '#/components/responses/ListCAs'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    post:
      operationId: add_ca
      tags:
        - "Certificate Authorities"
      summary: Add a CA.
      description: |
        When adding a CA you need to choose a “handle”, essentially just a
        name. The term “handle” comes from RFC 8183 and is used in the
        communication protocol between CAs and CAs and publication servers.

        When a CA has been added, it is registered to publish locally in the
        Krill instance where it exists, but other than that it has no
        configuration yet. In order to do anything useful with a CA you will
        first have to add at least one parent to it, and then most likely some
        Route Authorizations and/or Child CAs.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddCARequest'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '400':
          $ref: '#/components/responses/CaDuplicateResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}:
    get:
      operationId: get_ca
      tags:
        - "Certificate Authorities"
      summary: Get CA.
      description: Get CA details.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/GetCA'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/child_request.{format}:
    get:
      operationId: get_ca_child_request
      tags:
        - "Certificate Authorities"
      summary: Get CA RFC 8183 Request.
      description: Gets the RFC 8181 Child Request for this CA as JSON or XML.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/format'
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Rfc8183'
            application/xml:
              schema:
                $ref: '#/components/schemas/RFC8183RequestXML'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/children:
    post:
      operationId: add_child_ca
      tags:
        - "Certificate Authorities"
      summary: Add a child CA.
      description: |
        This adds a child CA. The request body must include a JSON
        representation of the [RFC 8183 Child Request XML](https://tools.ietf.org/html/rfc8183#section-5.2.1),
        though the 'tag' and 'child_handle' attributes are ignored.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddCAChildRequest'
            examples:
              child:
                value:
                  handle: 'ca'
                  resources:
                    asn: 'AS1'
                    v4: '10.0.0.0/8'
                    v6: '::'
                  auth:
                    rfc8183:
                      tag: null
                      child_handle: 'ca'
                      id_cert: '<base64>'
      responses:
        '200':
          $ref: '#/components/responses/Rfc6492'
        '400':
          description: Bad request parameters.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaChildDuplicateResponse'
                  - $ref: '#/components/schemas/CaChildResourcesRequiredResponse'
                  - $ref: '#/components/schemas/CaChildResourcesExtraResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/children/{child_handle}:
    get:
      operationId: get_child_ca
      tags:
        - "Certificate Authorities"
      summary: Get child details.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/child_handle'
      responses:
        '200':
          $ref: '#/components/responses/GetChildCA'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Unknown resource.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaChildUnknownResponse'
                  - $ref: '#/components/schemas/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    post:
      operationId: update_child_ca
      tags:
        - "Certificate Authorities"
      summary: Update an existing child of a CA.
      description: |
        This action is idempotent.
        **Note:** You can only update the complete resource set! If you leave
        out a resource - like asn in the example - then the child will lose all
        resources of that type.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/child_handle'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateCAChildRequest'
            examples:
              update_resources:
                summary: Update the resources for a child.
                value:
                  id_cert: null
                  resources:
                    asn: ''
                    v4: '10.0.0.0/8'
                    v6: '::'
              update_id_cert:
                summary: Update the ID certificate for a remote child.
                value:
                  id_cert: '<base64>'
                  resources: null
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Unknown resource.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaChildUnknownResponse'
                  - $ref: '#/components/schemas/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    delete:
      operationId: delete_child_ca
      tags:
        - "Certificate Authorities"
      summary: Remove a child CA.
      description: |
        Removes a child, revokes its certificates and removes them from the
        repository. Use with care, although you can re-add a removed child,
        this is probably best avoided.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/child_handle'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Unknown resource.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaChildUnknownResponse'
                  - $ref: '#/components/schemas/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/children/{child_handle}/contact:
    get:
      operationId: get_child_ca_parent_contact
      tags:
        - "Certificate Authorities"
      summary: Get parent contact for a child.
      description: |
        This is the parent contact that a child can use when adding the parent.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/child_handle'
      responses:
        '200':
          $ref: '#/components/responses/Rfc8183O'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Unknown resource.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaChildUnknownResponse'
                  - $ref: '#/components/schemas/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/children/{child_handle}/parent_response.{format}:
    get:
      operationId: get_child_ca_parent_response
      tags:
        - "Certificate Authorities"
      summary: Get the RFC 8183 Parent Response for a child.
      description: |
        To get the RFC 8183 Parent Response for a child.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/child_handle'
        - $ref: '#/components/parameters/format'
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Rfc6492'
            application/xml:
              schema:
                $ref: '#/components/schemas/RFC8183ParentResponseXML'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: Unknown resource.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaChildUnknownResponse'
                  - $ref: '#/components/schemas/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/id:
    post:
      operationId: regenerate_ca_id_cert
      tags:
        - "Certificate Authorities"
      summary: Regenerate CA ID certificate.
      description: |
        Tells the CA to create a new ID certificate and forget its old ID. Note
        that if you do this, you will have to create new RFC 8181 Child Request
        and Publisher Request XML for the parent CA(s) and Repository. Don't
        use this if you can avoid it.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/parents:
    post:
      operationId: add_ca_parent
      tags:
        - "Certificate Authorities"
      summary: Add a parent to a CA.
      description: |
        Add a parent to the CA. Note that your CA will only request a certificate
        from any of its parents after a repository has been configured for it.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddParentCARequest'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '400':
          description: Bad request parameters.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaParentDuplicateResponse'
                  - $ref: '#/components/schemas/CaParentIssueResponse'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/parents/{parent_handle}:
    get:
      operationId: get_ca_parent_contact
      tags:
        - "Certificate Authorities"
      summary: Get parent contact for a CA.
      description: |
        Get the parent contact information that a CA has for a parent.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/parent_handle'
      responses:
        '200':
          $ref: '#/components/responses/Rfc6492'
        '403':
          $ref: '#/components/responses/Forbidden'
        '400':
          $ref: '#/components/responses/CaParentUnknownResponse'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    post:
      operationId: update_ca_parent_contact
      tags:
        - "Certificate Authorities"
      summary: Update the contact information for an existing parent.
      description: |
        Should not be needed often, but say that your parent updates their ID
        cert or service URI for RFC 6492, then you will need to tell the CA.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/parent_handle'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Rfc6492'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '400':
          description: Bad request parameters.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaParentUnknownResponse'
                  - $ref: '#/components/schemas/CaParentIssueResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    delete:
      operationId: delete_ca_parent
      tags:
        - "Certificate Authorities"
      summary: Remove a parent.
      description: |
        Remove a parent from a CA.
        **Note:** this is just the child removing the parent, and this does not
        remove the child from the parent.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/parent_handle'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '400':
          $ref: '#/components/responses/CaParentUnknownResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/repo:
    get:
      operationId: get_ca_repository
      tags:
        - "Certificate Authorities"
      summary: Get Repository for a CA.
      description: |
        Returns details about the repository.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/GetRepositoryForCA'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    post:
      operationId: update_ca_repository
      tags:
        - "Certificate Authorities"
      summary: Update the Repository for a CA.
      description: |
        This will update the repository for a CA. I.e. it will trigger the
        following:
          - A check that the new Repository can be reached and allows the CA to
            connect.
          - Re-issue all objects using the base uri for the new repository.
          - Publish the new objects.
          - Request new certificates with SIA entries pointing to the new
            locations.
          - (best effort) Clean up of the old repository.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Rfc8181'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '400':
          description: Bad request parameters.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaRepoSameResponse'
                  - $ref: '#/components/schemas/CaRepoIssueResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/repo/request.{format}:
    get:
      operationId: get_ca_publisher_request
      tags:
        - "Certificate Authorities"
      summary: Get the RFC 8183 Publisher Request for a CA.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
        - $ref: '#/components/parameters/format'
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rfc8181Base'
            application/xml:
              schema:
                $ref: '#/components/schemas/RFC8183PublisherRequestXML'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/keys/roll_init:
    post:
      operationId: init_key_roll
      tags:
        - "Key Rolls"
      summary: Initiate a key roll.
      description: |
        When a key roll is initiated the following steps are executed:
        - A new key pair is created in state 'pending'.
        - A resource certificate is requested for the new key.

        The resource class will now have state 'RollPending'

        However, you may not observe this for long, as the request is sent to
        the parent immediately, and as soon as a certificate is received for
        the new key, the state moves from 'RollPending' to 'RollNew' and a MFT
        and CRL are published for the new key. All other objects (ROAs,
        delegated certificates) are still published under the active key.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/keys/roll_activate:
    post:
      operationId: activate_key_roll
      tags:
        - "Key Rolls"
      summary: Finish a key roll.
      description: |
        According the RFC new keys can be activated only after 24 hours. In
        practice however, this can also be done sooner. The main thing to keep
        in mind is that is only done after the parent CA has *published* the
        new certificate for the 'new' key - which might be some time after you
        actually received the certificate.

        In short: it's best to perform this step 24 hours after initialising a
        key roll, but if your old key is really compromised then you should
        probably just go ahead and do this asap.

        When a key roll is finished, the following happens:
        - The state is moved from 'RollNew' to 'RollOld'.
        - The new key becomes 'active' and will now also publish ROAs and
          delegates certs.
        - The former 'active' key becomes 'old' and only publishes a manifest
          and CRL, but no other objects.
        - A revocation request for the 'old' key is created.

        This state is also easy to miss, because Krill will immediately (but
        asynchronously) send the revocation request to the applicable parent
        and when it receives confirmation that the key is revoked it will:
        - Withdraw the manifest and crl for that key.
        - Move the state to 'Active' (and forget the old key).
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /bulk/cas/publish:
    post:
      operationId: republish_all_cas
      tags:
        - "Certificate Authorities"
      summary: Force that all CAs create new objects if needed (in which case they will also sync).
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'

  /bulk/cas/sync/parents:
    post:
      operationId: refresh_all_cas
      tags:
        - "Certificate Authorities"
      summary: Force that all CAs ask their parents for updated certificates.
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'

  /bulk/cas/sync/repo:
    post:
      operationId: resync_all_cas
      tags:
        - "Certificate Authorities"
      summary: Force that all CAs sync with their repo server.
      responses:
        '200':
          $ref: '#/components/responses/Success'
        '403':
          $ref: '#/components/responses/Forbidden'

  /cas/{ca_handle}/routes:
    get:
      operationId: list_route_authorizations
      tags:
        - "Route Authorizations"
      summary: List route authorizations.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ROA'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

    post:
      operationId: update_route_authorizations
      tags:
        - "Route Authorizations"
      summary: Update route authorizations.
      description: |
        Updates the ROA configurations. Users of a CA can configure which
        routes they want to be authorized, and Krill will then take care of
        creating the actual ROA RPKI objects.

        Updates are sent as a delta containing all additions and removals. This
        is done because often it is needed to update multiple ROAs in a single
        transaction in order to avoid invalidating certain announcements. E.g.
        when you have announcements from more than one ASN, or when you also
        announce more specific prefixes.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ROADelta'

      responses:
        '200':
          $ref: '#/components/responses/Success'
        '400':
          description: Bad request parameters.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/CaRoaDuplicateResponse'
                  - $ref: '#/components/schemas/CaRoaUnknownResponse'
                  - $ref: '#/components/schemas/CaRoaNotEntitledResponse'
                  - $ref: '#/components/schemas/CaRoaInvalidMaxLengthResponse'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/CaUnknownResponse'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/routes/analysis/full:
    get:
      operationId: bgp_analysis_full
      tags:
        - "Route Authorizations"
      summary: Show full analysis of all ROAs and Announcments for CA resources
      description: |
        Show all known announcements for the CA's resources and their RPKI validity
        state compared to the CA's ROAs, as well as all the CA's ROAs and how they
        affect the validatity state of known announcements.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/BgpFull'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

  /cas/{ca_handle}/issues:
    get:
      operationId: show_ca_issues
      tags:
        - "Certificate Authorities"
      summary: Show issues for a CA.
      description: |
        Issues currently include reachability or authentication
        issues between the CA and its repository and/or parents. This may be
        extended with other issues in future.
      parameters:
        - $ref: '#/components/parameters/ca_handle'
      responses:
        '200':
          $ref: '#/components/responses/CertAuthIssues'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/GeneralErrorResponse'

externalDocs:
  description: Read the Krill documentation
  url: https://rpki.readthedocs.io/en/latest/krill/

components:
  securitySchemes:
    KRILL_AUTH_TOKEN:
      type: http
      scheme: bearer
      bearerFormat: KRILL_AUTH_TOKEN

  parameters:
    ca_handle:
      in: path
      name: ca_handle
      schema:
        $ref: '#/components/schemas/Handle'
      required: true
    child_handle:
      in: path
      name: child_handle
      schema:
        $ref: '#/components/schemas/Handle'
      required: true
    parent_handle:
      in: path
      name: parent_handle
      schema:
        $ref: '#/components/schemas/Handle'
      required: true
    publisher_handle:
      in: path
      name: publisher_handle
      schema:
        $ref: '#/components/schemas/Handle'
      required: true
    format:
      in: path
      name: format
      schema:
        type: string
        enum: ['json','xml']
      required: true
    seconds:
      in: path
      name: seconds
      schema:
        type: integer
      required: true

  schemas:
    # Types ordered fundamental to complex
    Handle:
      type: string
      maxLength: 255
      pattern: '[\-_A-Za-z0-9/]*'
    IdCert:
      type: string
      format: base64
    PemIdCert:
      type: object
      nullable: true
      properties:
        pem:
          type: string
          format: pem
        hash:
          type: string
          format: hash
    RepoInfo:
      type: object
      properties:
        base_uri:
          type: string
          format: uri
        rpki_notify:
          type: string
          format: uri
    Resources:
      type: object
      properties:
        asn:
          type: string
        v4:
          type: string
        v6:
          type: string
      example:
        asn: ""
        v4: "10.0.0.0/0"
        v6: "2001:db8::/32"
    ROA:
      type: object
      properties:
        asn:
          type: string
        prefix:
          type: string
        max_length:
          type: integer
    ROADelta:
      type: object
      properties:
        added:
          type: array
          items:
            $ref: '#/components/schemas/ROA'
        removed:
          type: array
          items:
            $ref: '#/components/schemas/ROA'
    ServiceUri:
      type: string
      format: uri
    rfcCommon:
      type: object
      properties:
        tag:
          type: string
          nullable: true
        id_cert:
          $ref: '#/components/schemas/IdCert'
    Rfc6492:
      allOf:
        - $ref: '#/components/schemas/rfcCommon'
        - type: object
          properties:
            parent_handle:
              $ref: '#/components/schemas/Handle'
            child_handle:
              $ref: '#/components/schemas/Handle'
            service_uri:
              $ref: '#/components/schemas/ServiceUri'
    rfc8181Base:
      allOf:
        - $ref: '#/components/schemas/rfcCommon'
        - type: object
          properties:
            publisher_handle:
              $ref: '#/components/schemas/Handle'
    Rfc8181:
      allOf:
        - $ref: '#/components/schemas/rfc8181Base'
        - type: object
          properties:
            service_uri:
              $ref: '#/components/schemas/ServiceUri'
            repo_info:
              $ref: '#/components/schemas/RepoInfo'
    Rfc8183:
      allOf:
        - $ref: '#/components/schemas/rfcCommon'
        - type: object
          properties:
            child_handle:
              $ref: '#/components/schemas/Handle'
    RFC8183PublisherRequestXML:
      type: object
      properties:
        xmlns:
          type: string
          format: url
          xml:
            attribute: true
        version:
          type: integer
          xml:
            attribute: true
        publisher_handle:
          type: string
          xml:
            attribute: true
        publisher_bpki_ta:
          type: string
          format: base64
      xml:
        name: 'publisher_request'
      example:
        xmlns: http://www.hactrn.net/uris/rpki/rpki-setup/
        version: 1
        publisher_handle: 'child'
        publisher_bpki_ta: 'MIID..6g=='
    RFC8183RequestXML:
      type: object
      properties:
        xmlns:
          type: string
          format: url
          xml:
            attribute: true
        version:
          type: integer
          xml:
            attribute: true
        child_handle:
          type: string
          xml:
            attribute: true
        child_bpki_ta:
          type: string
          format: base64
      xml:
        name: 'child_request'
      example:
        xmlns: http://www.hactrn.net/uris/rpki/rpki-setup/
        version: 1
        child_handle: 'child'
        child_bpki_ta: 'MIID..6g=='
    RFC8183RepositoryResponseXML:
      type: object
      properties:
        xmlns:
          type: string
          format: url
          xml:
            attribute: true
        version:
          type: integer
          xml:
            attribute: true
        publisher_handle:
          type: string
          xml:
            attribute: true
        service_uri:
          type: string
          format: uri
          xml:
            attribute: true
        sia_base:
          type: string
          format: uri
          xml:
            attribute: true
        rrdp_notification_uri:
          type: string
          format: uri
          xml:
            attribute: true
        repository_bpki_ta:
          type: string
          format: base64
      xml:
        name: 'repository_response'
      # The example below is not shown by ReDoc, presumably due to:
      # https://github.com/Redocly/redoc/issues/492
      example:
        xmlns: http://www.hactrn.net/uris/rpki/rpki-setup/
        version: 1
        publisher_handle: 'ta'
        service_uri: 'https://localhost:3000/rfc8181/ta'
        sia_base: 'rsync://localhost/repo/ta/'
        rrdp_notification_uri: 'https://localhost:3000/rrdp/notification.xml'
        repository_bpki_ta: 'MIID..aQ=='
    RFC8183ParentResponseXML:
      type: object
      properties:
        xmlns:
          type: string
          format: url
          xml:
            attribute: true
        version:
          type: integer
          xml:
            attribute: true
        service_uri:
          type: string
          format: uri
          xml:
            attribute: true
        child_handle:
          type: string
          xml:
            attribute: true
        parent_handle:
          type: string
          xml:
            attribute: true
        parent_bpki_ta:
          type: string
          format: base64
      xml:
        name: 'parent_response'
      example:
        xmlns: http://www.hactrn.net/uris/rpki/rpki-setup/
        version: 1
        service_uri: 'https://localhost:3000/rfc6492/ta'
        child_handle: 'child'
        parent_handle: 'ta'
        parent_bpki_ta: 'MIID..6g=='
    PendingKey:
      type: object
      properties:
        key_id:
          type: string
    CertifiedKey:
      allOf:
        - $ref: '#/components/schemas/PendingKey'
        - type: object
          properties:
            incoming_cert:
              type: object
              properties:
                cert:
                  type: string
                  format: base64
                uri:
                  type: string
                  format: uri
                resources:
                  $ref: '#/components/schemas/Resources'
            request:
              type: string
              nullable: true

    # Request bodies
    AddCARequest:
      type: object
      required:
        - handle
      properties:
        handle:
          allOf:
            - $ref: '#/components/schemas/Handle'
            - description: The handle attribute uniquely identifies the new Certificate Authority within this Krill instance.
    AddCAChildRequest:
      type: object
      required:
        - handle
        - resources
        - auth
      properties:
        handle:
          allOf:
            - $ref: '#/components/schemas/Handle'
            - description: The handle attribute uniquely identifies the new Certificate Authority within this Krill instance.
        resources:
          $ref: '#/components/schemas/Resources'
        auth:
          $ref: '#/components/schemas/Rfc8183'
    UpdateCAChildRequest:
      type: object
      properties:
        id_cert:
          allOf:
            - $ref: '#/components/schemas/IdCert'
            - description: |
                Base64 of DER encoded is PEM encoded minus the BEGIN and END
                markers.
            - nullable: true
        resources:
          allOf:
            - $ref: '#/components/schemas/Resources'
            - nullable: true
    AddParentCARequest:
      type: object
      required:
        - handle
        - contact
      properties:
        handle:
          allOf:
            - $ref: '#/components/schemas/Handle'
            - description: The local handle by which your ca refers to this parent.
        contact:
          $ref: '#/components/schemas/Rfc6492'
    AddPublisherRequest:
      type: object
      required:
        - publisher_handle
        - id_cert
      properties:
        publisher_handle:
          $ref: '#/components/schemas/Handle'
        tag:
          type: string
        id_cert:
          $ref: '#/components/schemas/IdCert'
      externalDocs:
        url: https://tools.ietf.org/html/rfc8183#section-5.2.3

    # Error codes ordered ascending by error code
    PubDuplicateResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [pub-duplicate]
        msg:
          type: string
          example: Duplicate publisher 'ca'
        args:
          type: object
          required:
            - publisher
          properties:
            publisher:
              type: string
              example: ca
    PubUnknownResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [pub-unknown]
        msg:
          type: string
          example: Unknown publisher 'ca'
        args:
          required:
            - publisher
          properties:
            publisher:
              type: string
              example: ca
    CaRepoSameResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-repo-same]
        msg:
          type: string
          example: CA 'ca' already using this repository
        args:
          required:
            - ca
          properties:
            ca:
              type: string
              example: ca
    CaRepoIssueResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-repo-issue]
        msg:
          type: string
          example: CA 'ca' got error from repository 'cannot connect'
        args:
          required:
            - ca
            - cause
          properties:
            ca:
              type: string
              example: ca
            cause:
              type: string
              example: cannot connect
    CaChildDuplicateResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-child-duplicate]
        msg:
          type: string
          example: CA 'ca' already has a child named 'child'
        args:
          required:
            - ca
            - child
          properties:
            ca:
              type: string
              example: ca
            child:
              type: string
              example: child


    CaChildUnknownResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-child-unknown]
        msg:
          type: string
          example: CA 'ca' does not have a child named 'child'
        args:
          required:
            - ca
            - child
          properties:
            ca:
              type: string
              example: ca
            child:
              type: string
              example: child

    CaChildResourcesRequiredResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-child-resources-required]
        msg:
          type: string
          example: Child 'child' for CA 'ca' MUST have resources specified
        args:
          required:
            - ca
            - child
          properties:
            ca:
              type: string
              example: ca
            child:
              type: string
              example: child

    CaChildResourcesExtraResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-child-resources-extra]
        msg:
          type: string
          example: Child cannot have resources not held by parent.
        args:
          required:
            - ca
            - child
          properties:
            ca:
              type: string
              example: ca
            child:
              type: string
              example: child

    CaParentDuplicateResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-parent-duplicate]
        msg:
          type: string
          example: CA 'ca' already has a parent named 'parent'
        args:
          required:
            - ca
            - parent
          properties:
            ca:
              type: string
              example: ca
            parent:
              type: string
              example: parent

    CaParentUnknownResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-parent-unknown]
        msg:
          type: string
          example: CA 'ca' does not have a parent named 'parent'
        args:
          required:
            - ca
            - parent
          properties:
            ca:
              type: string
              example: ca
            parent:
              type: string
              example: parent

    CaParentIssueResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-parent-issue]
        msg:
          type: string
          example: CA 'ca' got error from parent 'parent' cause
        args:
          required:
            - ca
            - parent
            - cause
          properties:
            ca:
              type: string
              example: ca
            parent:
              type: string
              example: parent
            cause:
              type: string
              example: cause

    BgpFullSchema:
      type: array
      items:
        type: object
        required:
          - asn
          - prefix
          - max_length
          - state
          - allowed_by
          - disallowed_by
          - authorizes
          - disallows
        properties:
          asn:
            type: integer
          prefix:
            type: string
          max_length:
            type: integer
            nullable: true
          state:
            type: string
          allowed_by:
            type: array
            items:
              type: object
              required:
                - asn
                - prefix
                - max_length
              properties:
                asn:
                  type: integer
                prefix:
                  type: string
                max_length:
                  type: integer
                  nullable: true
          disallowed_by:
            type: array
            items:
              type: object
              required:
                - asn
                - prefix
                - max_length
              properties:
                asn:
                  type: integer
                prefix:
                  type: string
                max_length:
                  type: integer
                  nullable: true
          allows:
            type: array
            items:
              type: object
              required:
                - asn
                - prefix
              properties:
                asn:
                  type: integer
                prefix:
                  type: string
          disallows:
            type: array
            items:
              type: object
              required:
                - asn
                - prefix
              properties:
                asn:
                  type: integer
                prefix:
                  type: string

    CaRoaUnknownResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-roa-unknown]
        msg:
          type: string
          example: Cannot remove unknown ROA '10.0.0.0/20-24 => 65536' from CA 'ca'
        args:
          required:
            - ca
            - asn
            - prefix
            - max_length
          properties:
            ca:
              type: string
              example: ca
            asn:
              type: string
              example: 65536
            prefix:
              type: string
              example: 10.0.0.0/20
            max_length:
              type: string
              nullable: true
              example: 24


    CaRoaDuplicateResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-roa-duplicate]
        msg:
          type: string
          example: Duplicate ROA '10.0.0.0/20-24 => 65536' for CA 'ca'
        args:
          required:
            - ca
            - asn
            - prefix
            - max_length
          properties:
            ca:
              type: string
              example: ca
            asn:
              type: string
              example: 65536
            prefix:
              type: string
              example: 10.0.0.0/20
            max_length:
              type: string
              nullable: true
              example: 24

    CaRoaInvalidMaxLengthResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-roa-invalid-max-length]
        msg:
          type: string
          example: Invalid max length in ROA '10.0.0.0/20-24 => 65536' for CA 'ca'
        args:
          required:
            - ca
            - asn
            - prefix
            - max_length
          properties:
            ca:
              type: string
              example: ca
            asn:
              type: string
              example: 65536
            prefix:
              type: string
              example: 10.0.0.0/20
            max_length:
              type: string
              nullable: true
              example: 24

    CaRoaNotEntitledResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-roa-not-entitled]
        msg:
          type: string
          example: Prefix in ROA '10.0.0.0/20-24 => 65536' not held by CA 'ca'
        args:
          required:
            - ca
            - asn
            - prefix
            - max_length
          properties:
            ca:
              type: string
              example: ca
            asn:
              type: string
              example: 65536
            prefix:
              type: string
              example: 10.0.0.0/20
            max_length:
              type: string
              nullable: true
              example: 24

    CaDuplicateResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-duplicate]
        msg:
          type: string
          example: CA 'ca' was already initialised
        args:
          required:
            - ca
          properties:
            ca:
              type: string
              example: ca

    CaUnknownResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [ca-unknown]
        msg:
          type: string
          example: CA 'ca' is unknown
        args:
          required:
            - ca
          properties:
            ca:
              type: string
              example: ca

    GeneralErrorResponse:
      type: object
      required:
        - label
        - msg
        - args
      properties:
        label:
          type: string
          enum: [general-error]
        msg:
          type: string
          example: cause
        args:
          required:
            - cause
          properties:
            cause:
              type: string
              example: cause

  responses:
    Success:
      description: Success.

    Forbidden:
      description: Forbidden (incorrect authentication token).

    NotFound:
      description: Not Found.

    CertAuthIssues:
      description: Issues for a CA (e.g. cannot reach parent)
      content:
        application/json:
          schema:
            type: object
            properties:
              repo:
                type: string
              parents:
                type: array
                items:
                  type: string
                  additionalProperties:
                    type: string
            example:
              repo: "repostory unreachable"
              parents:
                "rir": "denied!"
                "nir": "cannot connect"


    PubDuplicateResponse:
      description: Publisher handle already in use
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PubDuplicateResponse'

    PubUnknownResponse:
      description: Unknown publisher
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/PubUnknownResponse'


    CaRepoSameResponse:
      description: Same Repository
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaRepoSameResponse'

    CaRepoIssueResponse:
      description: Issue from repository for CA
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaRepoIssueResponse'

    CaChildDuplicateResponse:
      description: Duplicate child
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaChildDuplicateResponse'

    CaChildUnknownResponse:
      description: Unknown child
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaChildUnknownResponse'

    CaChildResourcesRequiredResponse:
      description: Child requires resources
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaChildResourcesRequiredResponse'

    CaChildResourcesExtraResponse:
      description: Child resources not held by CA
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaChildResourcesExtraResponse'

    CaParentDuplicateResponse:
      description: Duplicate parent
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaParentDuplicateResponse'

    CaParentUnknownResponse:
      description: Unknown parent
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaParentUnknownResponse'

    CaParentIssueResponse:
      description: Issue communicating with parent
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaParentIssueResponse'

    BgpFull:
      description: |
        Full ROAs vs known BGP Announcements report for this CA.

        This is an array of both ROAs and Announcements, including all optional
        information that may be applicable to either. I.e. even though the schema
        includes max_length this value will not be present for announcements. The
        arrays for 'allows' and 'disallows' will always be empty for announcements,
        as will the arrays for 'allowed_by' and 'disallowed_by' for ROAs.

        Confusing as this might be, this allows for parsing all kinds of states
        in a single table. If you want to look at announcements or ROAs only, please
        look at the other more specific BGP analysis endpoints for those.

        Possible state values are: roa_seen, roa_seen, announcement_valid,
        announcement_invalid_length, announcement_invalid_asn, announcement_not_found,
        roa_no_announcement_info
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BgpFullSchema'

    CaRoaUnknownResponse:
      description: 'Invalid ROA delta: removing a definition which is unknown'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaRoaUnknownResponse'

    CaRoaDuplicateResponse:
      description: 'Invalid ROA delta: adding a definition which is already present'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaRoaDuplicateResponse'

    CaRoaInvalidMaxLengthResponse:
      description: 'Invalid ROA delta: not all resources held.'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaRoaInvalidMaxLengthResponse'

    CaRoaNotEntitledResponse:
      description: 'Invalid ROA delta: not all resources held.'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaRoaNotEntitledResponse'

    CaDuplicateResponse:
      description: CA handle already in use.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaDuplicateResponse'

    CaUnknownResponse:
      description: Unknown CA
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CaUnknownResponse'

    GeneralErrorResponse:
      description: General CA Server issue.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/GeneralErrorResponse'

    GetCA:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              handle:
                $ref: '#/components/schemas/Handle'
              id_cert:
                $ref: '#/components/schemas/PemIdCert'
              repo_info:
                $ref: '#/components/schemas/RepoInfo'
              parents:
                type: array
                items:
                  type: object
                  properties:
                    handle:
                      $ref: '#/components/schemas/Handle'
                    kind:
                      type: string
              resources:
                $ref: '#/components/schemas/Resources'
              resources_classes:
                type: object
                additionalProperties:
                  x-additionalPropertiesName: resource index
                  type: object
                  properties:
                    name_space:
                      type: string
                    parent_handle:
                      $ref: '#/components/schemas/Handle'
                    keys:
                      oneOf:
                        - type: object
                          title: pending
                          properties:
                            pending:
                              type: object
                              properties:
                                pending_key:
                                  $ref: '#/components/schemas/PendingKey'
                        - type: object
                          title: active
                          properties:
                            active:
                              type: object
                              properties:
                                active_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                        - type: object
                          title: roll_pending
                          properties:
                            roll_pending:
                              type: object
                              properties:
                                active_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                                pending_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                        - type: object
                          title: roll_new
                          properties:
                            roll_new:
                              type: object
                              properties:
                                new_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                                active_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                        - type: object
                          title: roll_old
                          properties:
                            roll_old:
                              type: object
                              properties:
                                old_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                                active_key:
                                  $ref: '#/components/schemas/CertifiedKey'
                    current_objects:
                      type: object
                      additionalProperties:
                        x-additionalPropertiesName: object name
                        type: object
                        properties:
                          content:
                            type: string
                            format: base64
                          serial:
                            type: string
                          expires:
                            type: string
                            format: date-time
              children:
                type: array
                items:
                  type: string
          example:
            handle: 'ca'
            repo_info:
              base_uri: 'rsync://localhost/repo/ca/'
              rpki_notify: 'https://localhost:3000/rrdp/notification.xml'
            parents:
              - handle: 'ta'
                kind: 'ta'
            resources:
              asn: 'AS1-AS10'
              v4: '10.0.0.0/8'
              v6: '::/128'
            resource_classes:
              '0':
                name_space: '0'
                parent_handle: 'ta'
                keys:
                  active:
                    active_key:
                      key_id: 'B738..8820'
                      incoming_cert:
                        cert: '<base64>'
                        uri: 'rsync://localhost/repo/ta/0/B738..8820.cer'
                        resources:
                          asn: 'AS0-AS10'
                          v4: '10.0.0.0/8'
                          v6: '::/128'
                      request: null
                current_objects:
                  '2DCE..5337.crl':
                    content: '<base64>'
                    serial: '2'
                    expires: '2019-11-27T10:56:16.166449Z'
                  '2DCE..5337.mft':
                    content: '<base64>'
                    serial: '87065729750653489815092730763761996670858255271'
                    expires: '2019-11-27T10:56:16.172248Z'
            children:
              - 'child'

    ListCAs:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              cas:
                type: array
                items:
                  type: object
                  properties:
                    handle:
                      allOf:
                        - $ref: '#/components/schemas/Handle'
                        - description: The RFC-8183 handle that uniquely identifies the CA in this Krill instance.

    GetChildCA:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              id_cert:
                $ref: '#/components/schemas/PemIdCert'
              entitled_resources:
                $ref: '#/components/schemas/Resources'

    ListPublishers:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              publishers:
                type: array
                items:
                  type: object
                  properties:
                    handle:
                      $ref: '#/components/schemas/Handle'
                    links:
                      type: array
                      items:
                        type: object
                        properties:
                          rel:
                            type: string
                            enum: [self]
                          link:
                            type: string
                            format: uri
          example:
            publishers:
              - handle: 'ca'
                links:
                  rel: 'self'
                  link: '/api/v1/publishers/ca'

    GetPublisher:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              handle:
                $ref: '#/components/schemas/Handle'
              id_cert:
                $ref: '#/components/schemas/IdCert'
              base_uri:
                type: string
                format: uri
              current_files:
                type: array
                items:
                  type: object
                  properties:
                    base64:
                      type: string
                      format: base64
                    uri:
                      type: string
                      format: uri
          example:
            handle: 'child'
            id_cert: 'MIID..zw=='
            base_uri: 'rsync://<KRILL_SERVER_FQDN>/repo/child/'
            current_files:
              - base64: 'MIIK..TZPZ'
                uri: 'rsync://<KRILL_SERVER_FQDN>/repo/child/0/A815..A01C.mft'
              - base64: 'MIIB..6Lg8'
                uri: 'rsync://<KRILL_SERVER_FQDN>/repo/child/0/A815..A01C.crl'
              - base64: 'MIIJ..Cg4='
                uri: 'rsync://<KRILL_SERVER_FQDN>/repo/child/0/3130..3936.roa'

    AddPublisher:
      description: Success.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Rfc8181'

    StalePublishers:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              publishers:
                type: array
                items:
                  type: object
                  properties:
                    handle:
                      $ref: '#/components/schemas/Handle'
                    links:
                      type: array
                      items:
                        type: object
                        properties:
                          rel:
                            type: string
                            enum: [self]
                          link:
                            type: string
                            format: uri
          example:
            publishers:
              - handle: 'ca'
                links:
                  rel: 'self'
                  link: '/api/v1/publishers/ca'

    GetRepositoryForCA:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              contact:
                type: object
                properties:
                  rfc8181:
                    $ref: '#/components/schemas/Rfc8181'
          examples:
            contact:
              value:
                contact:
                  rfc8181:
                    tag: null
                    publisher_handle: 'ca'
                    id_cert: 'MIID..Vg=='
                    service_uri: 'https://localhost:3000/rfc8181/ca'
                    repo_info:
                      base_uri: 'rsync://localhost/repo/ca/'
                      rpki_notify: 'https://localhost:3000/rrdp/notificati.xml'

    GetCAHistory:
      description: Success.
      content:
        application/json:
          schema:
            type: object
            properties:
              init:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Handle'
                  version:
                    type: integer
                  details:
                    type: object
              events:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      $ref: '#/components/schemas/Handle'
                    version:
                      type: integer
                    details:
                      type: object

    Rfc6492:
      description: Success.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Rfc6492'

    Rfc8183O:
      description: Success.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Rfc8183'