AnyCAGateway REST API

The AnyCAGateway REST API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. provides programmatic access to gateway-managed records and operations used to broker certificate lifecycle activities between Keyfactor Command and connected third-party certificate authorities. Rather than modifying configuration directly in Keyfactor Command or the external CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. provider, API operations act on records maintained within the gateway itself, which control how the gateway performs enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA)., revocation, validation, and synchronization on behalf of Command.

Through the AnyCAGateway REST API, authorized clients can manage gateway configuration and perform certificate lifecycle actions, including:

• Managing gateway-managed CA records that represent external cloud CAs.

• Searching for, enrolling for, and revoking certificates through the gateway.

• Configuring certificate profiles, end entity profiles, and claims used during enrollment.

• Managing domain validation records and identity providers used by the gateway.

• Performing additional gateway-specific configuration and supporting operations.

Documentation for the AnyCAGateway REST API is provided in two complementary resources:

• AnyCAGateway REST API Guide, which describes the available operations, required parameters, and expected request and response behavior.

• AnyGateway The Keyfactor AnyGateway is a generic third-party CA gateway framework that allows existing CA gateways and custom CA integrations to share a common product architecture. AnyGateway is available in two formats: a DCOM-based gateway and a REST-based gateway. The REST-based AnyGateway is the newer implementation and is recommended for new deployments. The DCOM-based AnyGateway is provided for compatibility with existing environments and is planned for eventual retirement. REST API Reference and Utility, an interactive API explorer based on the Swagger (OpenAPI) framework, which allows users to browse operations, review schemas, and execute authenticated requests directly against the gateway.

For security purposes, sensitive values such as client secrets are never returned in full and may be omitted or masked in API responses. Configuration changes made through the API are applied asynchronously and typically become effective within approximately 60 seconds.

Endpoint Common Features

All API endpoints are accessed under a base path that corresponds to an application hosted on the web server. This path is configurable during installation. The default base path is /AnyGatewayREST.

Each endpoint An endpoint is a URL that enables the API to gain access to resources on a server. consists of the base path followed by the API component name. Individual operations are performed by sending an HTTP method (for example, GET, POST, or PUT) to the endpoint.

For example, the endpoint for identity provider operations is:

Different HTTP methods sent to this endpoint perform different operations.

The API uses the following common request headers:

• Content-Type: application/json
• Authorization: Bearer <your OAuth token>

HTTP Statuses

The following HTTP Statuses may be returned by AnyCAGateway REST API requests:

• 200 OK: Request successful; results, if applicable, in response body.

• 204 No Content: Request successful; results in no response.

• 400 Bad Request: Malformed or invalid data; additional information may be available in the response body and/or AnyCAGateway REST server logs.

• 401 Unauthorized: Invalid credentials (user unauthenticated).

• 403 Forbidden: Can often indicate that the user does not have the appropriate permissions for this action in AnyCAGateway REST (user unauthorized).

• 404 Page not Found: Invalid request path.

• 405 Method Not Allowed: Invalid request; check the requested method (POST vs GET), the authentication credentials, and the endpoint path.

• 500 Internal Server Error: AnyCAGateway REST encountered an unexpected error attempting to handle the request. See response body and AnyCAGateway REST server logs for details.

• 502 Bad Gateway: AnyCAGateway REST attempted to contact Keyfactor Command or other upstream server to process the request, but was unable to. See AnyCAGateway REST server logs for details.