POST Enrollment Patterns

An array of strings indicating the security roles associated with the enrollment pattern. Only users holding ones of these roles will be able to use the enrollment pattern if UseADPermissions is False. For example:

 "AssociatedRoles": [
    "Administrators",
    "Power Users"
  ]

An array of objects defining default certificate subject values for an enrollment pattern. These values are used to prepopulate subject fields in the Management Portal during enrollment when using this pattern and apply only to enrollments made with this pattern. Enrollment pattern defaults take precedence over system-wide default subject settings. For more information about system-wide defaults, see GET Enrollment Patterns Settings.

Show enrollment pattern default details.

For example:

"Defaults": [
   {
      "SubjectPart": "L",
      "Value": "Denver"
   },
   {
      "SubjectPart": "ST",
      "Value": "Colorado"
   }
]

An array of objects defining custom enrollment fields for an enrollment pattern. These fields allow additional request attributes to be included with CSR and PFX enrollments and passed to the certificate authority (CA) during the enrollment process.

Custom enrollment fields can be used to:

• Enforce certificate request requirements and prevent invalid enrollments

• Provide additional information to the CA as part of the request

• Support integrations such as the Keyfactor Windows Enrollment Gateway, which uses enrollment fields for standard functionality

When configured, these fields are presented during CSR and PFX enrollment (for example, in the Additional Enrollment Fields section in the Management Portal) and must be completed as part of the request. The submitted values are passed to the CA and may appear in CA-issued certificate attributes, depending on CA configuration.

Show enrollment field details.

For example:

"EnrollmentFields": [
   {
      "Name": "MyCustomField",
      "DataType": 2,
      "Options": ["Green","Red","Yellow","Blue"]
   }
]

An array of objects containing regular expressions specific to an individual enrollment pattern, used to validate the subject data. Regular expressions defined on an enrollment pattern apply to enrollments made with that enrollment pattern only. Regular expressions defined for enrollment patterns take precedence over system-wide regular expressions. Show regular expression details.

^(?!-)(?!.*--)[A-Za-z0-9-]{1,63}(?<!-)(\.[A-Za-z0-9-]{1,63})*\.keyexample\.com$

.+

^(?:Key Example Inc|Key Example|Key Example, Inc\.)$

^(?:IT|HR|Accounting|E-Commerce)$

^(?:Boston|Chicago|New York|London|Dallas)$

^(?:Massachusetts|Illinois|New York|Ontario|Texas)$

^(?:US|CA)$

^[A-Za-z0-9._%'+-]+@keyexample\.com$

^(?!-)(?!.*--)[A-Za-z0-9-]{1,63}(?<!-)(\.[A-Za-z0-9-]{1,63})*\.(keyexample\.com|keyexample2\.com)$

^130\.101\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$

^(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:[0-9]{1,2}|1[0-9]{2}|2[0-4][0-9]|25[0-5])$

^([A-F0-9]{1,4}:){1,7}([A-F0-9]{1,4})?(\:\:([A-F0-9]{1,4}:){0,6}[A-F0-9]{1,4})?$

^[A-Za-z0-9._%'+-]+@keyexample\.com$

^[A-Za-z0-9'_ -]{1,64}@keyexample\.com$

For example:

"Regexes": [
   {
      "SubjectPart": "O",
      "Regex": "^(?:Key Example Company|Key Example\, Inc\.)$",
      "Error": "Organization must be Key Example, Inc or Key Example Company.",
      "CaseSensitive": true
   }
]

An integer indicating the template associated with the enrollment pattern.

Use the GET Templates operation to retrieve a list of all the templates to determine the template ID.

An array of objects indicating the security roles associated with the enrollment pattern. Only users holding ones of these roles will be able to use the enrollment pattern if UseADPermissions is False. Show role details.

An array of objects defining default certificate subject values for an enrollment pattern. These values are used to prepopulate subject fields in the Management Portal during enrollment when using this pattern and apply only to enrollments made with this pattern. Enrollment pattern defaults take precedence over system-wide default subject settings. For more information about system-wide defaults, see GET Enrollment Patterns Settings.

Show enrollment pattern default details.

An array of objects defining custom enrollment fields for an enrollment pattern. These fields allow additional request attributes to be included with CSR and PFX enrollments and passed to the certificate authority (CA) during the enrollment process.

Custom enrollment fields can be used to:

• Enforce certificate request requirements and prevent invalid enrollments

• Provide additional information to the CA as part of the request

• Support integrations such as the Keyfactor Windows Enrollment Gateway, which uses enrollment fields for standard functionality

When configured, these fields are presented during CSR and PFX enrollment (for example, in the Additional Enrollment Fields section in the Management Portal) and must be completed as part of the request. The submitted values are passed to the CA and may appear in CA-issued certificate attributes, depending on CA configuration.

Show enrollment field details.

An array of objects containing metadata field settings specific to an individual enrollment pattern. These metadata field configurations can override global metadata field configurations in these possible ways:

• Configuration on the metadata field of required, optional or hidden.

• The default value for the metadata field.

• A regular expression defined for the field (string fields only) against which entered data will be validated along with its associated message.

• For fields of data type multiple choice, the list of values that appear in multiple choice dropdowns.

Metadata field settings defined on an enrollment pattern apply to enrollments made with that enrollment pattern only and take precedence over global-level metadata field settings.

Show metadata field details.

^[a-zA-Z0-9'_\.\-]*@(keyexample\.org|keyexample\.com)$

An object containing the individual policy settings for the enrollment pattern. Policies defined on an enrollment pattern apply to enrollments made with that enrollment pattern only and take precedence over system-wide policies. For more information about system-wide enrollment pattern policies, see GET Enrollment Patterns Settings. Show enrollment pattern policy details.

Name	Description
Allow Key Reuse	A Boolean that indicates whether private key reuse is allowed (True or False). This option applies to certificate renewals. By default, this is set to true at a system-wide level.
Allow Wildcards	A Boolean that indicates whether wildcards are allowed (True or False). By default, this is set to true at a system-wide level.
AlternativeKeyAlgorithms	An array of objects containing the supported alternative key algorithms for the template as reported by the CA including the bit lengths and/or curves as appropriate. If the enrollment pattern is using the system-wide settings for this parameter, a value will not be returned. Show alternative key algorithm details. Name Description name A string indicating the name of the key algorithm. The supported key algorithm names are: ECDSA RSA Ed448 Ed25519 ML-DSA-44 ML-DSA-65 ML-DSA-87 bit_lengths An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. For RSA, Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. curves An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command, if applicable. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256” or “secp256r1”, not “P-256/prime256v1/secp256r1”).
Certificate Owner Role	An integer indicating the certificate owner role setting. The supported values are: 0: Optional: The field appears in PFX and CSR enrollment in the Management Portal, but the user is not required to enter a value. If a default owner is defined (either at the system-wide level or in the enrollment pattern) and the user does not enter a value, the default value is automatically applied upon submission. This default-value behavior applies to enrollments submitted through both the Management Portal and the Keyfactor API PFX and CSR enrollment operations. 1: Required: The field appears in PFX and CSR enrollment in the Management Portal, and a value must be provided before submission. The same requirement applies to enrollments submitted through the Keyfactor API PFX and CSR enrollment operations—a certificate owner value must be provided before submission in all cases. 2: Hidden: The field does not appear in PFX and CSR enrollment in the Management Portal, but if a default owner is defined (either at the system-wide level or in the enrollment pattern), that value is automatically applied upon submission. This default-value behavior applies to enrollments submitted through both the Management Portal and the Keyfactor API PFX and CSR enrollment operations.
CSRSANControl	An integer indicating the policy to apply when handling CSR SANs. This field can be used to configure how CSR subject alternative names (SANs) are handled. During enrollment, when submitting a CSR, this option can be configured to either replace the custom subject alternative names (SANs) supplied by CSR, merge with the custom subject alternative names (SANs) supplied by the CSR, or not allow custom subject alternative names (SANs) to be added to the CSR. Important:  This allows you to select, more directly and clearly, the option that is compatible with the CA you are using, since some CAs do not allow SAN replacement or merging. Note:  This functionality replaces the enrollment application setting Allow CSR SAN Entry. Options are: NULL - Indicates the global setting for enrollment patterns will be used. *Cannot be set to NULL for PUT /EnrollmentPattterns or PUT /EnrollmentPattterns/Settings. 0 - Off When this field is set to Off, the Subject Alternative Names section will not appear in the CSR Enrollment page. API requests that specify external SANs will have those ignored. This matches the prior behavior when the application setting was set to False. 1 - Replace When this field is set to Replace, the Subject Alternative Names section will appear in the CSR Enrollment page. If any external SANs are provided, those will be used by the workflow instead of the SANs from the CSR. If no external SANs are provided, the SANs from the CSR will be used by the workflow. This matches the prior behavior when the application setting was set to True. 2 - Merge When this field is set to Merge, the Subject Alternative Names section will appear in the CSR Enrollment page. Any external SANs provided will be merged with any SANs present in the CSR. Duplicates will be removed, and the result will be used in the workflow.
Default Certificate Owner Override	A Boolean that indicates whether the default certificate owner name from the system-wide policy should be overridden with a locally-configured value for the enrollment pattern (True or False).
Default Certificate Owner Role Id	An integer indicating the Keyfactor Command reference ID of the security role assigned as the default certificate owner for certificates enrolled or imported via synchronization or scanning with this enrollment pattern.
Default Certificate Owner Role Name	A string indicating the name of the security role to assign as the default certificate owner for certificates enrolled or imported via synchronization or scanning with this enrollment pattern.
KeyInfo	An object containing the supported key types for the enrollment pattern along with the bit lengths and/or curves for the key types as appropriate. If the enrollment pattern is using the system-wide settings for these, a value will not be returned. Important:  The KeyInfo parameter has been deprecated. It is retained for backwards compatibility, but all new development should use the PrimaryKeyAlgorithms and AlternativeKeyAlgorithms parameters. Show key info details. Name Description ECDSA An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command. RSA An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. Ed448 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. Ed25519 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. curves: There are no curves for this type of key. MLDSA44 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key. MLDSA65 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key. MLDSA87 An object containing the name of the key type and two arrays: name: A string indicating the name of the key type. bit_lengths: There are no key size choices for this type of key. curves: There are no curves for this type of key.
PrimaryKeyAlgorithms	An array of objects containing the supported primary key algorithms for the enrollment pattern as defined in the specific enrollment pattern policy, including the bit lengths and/or curves as appropriate. If the enrollment pattern is using the system-wide settings for this parameter, a value will not be returned. Show primary key algorithm details. Name Description name A string indicating the name of the key algorithm. The supported key algorithm names are: ECDSA RSA Ed448 Ed25519 ML-DSA-44 ML-DSA-65 ML-DSA-87 bit_lengths An array of integers indicating the key sizes supported for enrollment through Keyfactor Command. For RSA, Keyfactor Command supports key sizes 2048, 3072, 4096, 6144, 8192, and 16384. curves An array of strings indicating the elliptic curve algorithms that are supported for enrollment through Keyfactor Command, if applicable. ECC curves may be specified using the well-known OIDs for ECC algorithms or by friendly name. Well-known OIDs include: 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1 1.3.132.0.34 = P-384/secp384r1 1.3.132.0.35 = P-521/secp521r1 When specifying by friendly name, do not include a slash (use “P-256” or “secp256r1”, not “P-256/prime256v1/secp256r1”).
RFC Enforcement	A Boolean that indicates whether RFC 2818 compliance enforcement is turned on (True or False). When this option is set to True, certificate enrollments made through Keyfactor Command for this enrollment pattern must include at least one DNS SAN. In the Keyfactor Command Management Portal, this causes the following behavior: PFX Enrollment: The CN entered in PFX enrollment is automatically replicated as a DNS SAN, which the user does not see and cannot change. CSR Enrollment: If the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate. The user enrolling does not see this and cannot change it. CSR Generation: The CN entered will be automatically replicated as a DNS SAN and set to read only. By default, this is set to False at the system-wide level.

A Boolean indicating whether this enrollment pattern is the default pattern for the associated template (True or False). A certificate template can have only one default enrollment pattern, which is required for the template to be used for enrollment. If no other enrollment pattern for the template exists or is marked as default, this option will automatically be enabled when a new pattern is created.