One Identity Safeguard for Privileged Sessions 6.0.14 LTS

This endpoint references the certificates of SPS's internal Certificate Authority, Timestamping Authority, and the SSL certificate of the web and REST interface.

URL

GET https://<IP-address-of-SPS>/api/configuration/management/certificates

Cookies

Cookie name	Description	Required	Values
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API. Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Cookie name

Description

Required

Values

session_id

Contains the authentication token of the user

Required

The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Note that this session ID refers to the connection between the REST client and the SPS REST API. It is not related to the sessions that SPS records (and which also have a session ID, but in a different format).

Sample request

The following command lists the internal certificates of SPS.

curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/management/certificates

Response

The following is a sample response received when listing the internal certificates of SPS.

For details of the meta object, see Message format.

{
  "body": {
    "ca": {
      "selection": "identity",
      "x509_identity": {
        "key": "fbd684e1-e1ac-4f34-ad25-86c560c51e24",
        "meta": {
          "href": "/api/configuration/x509/fbd684e1-e1ac-4f34-ad25-86c560c51e24"
        }
      }
    },
    "server": {
      "key": "fd1c73e8-bcb8-4d13-991f-722f492dc074",
      "meta": {
        "href": "/api/configuration/x509/fd1c73e8-bcb8-4d13-991f-722f492dc074"
      }
    },
    "tsa": {
      "key": "20e72ede-78ef-460a-b843-68a35d994142",
      "meta": {
        "href": "/api/configuration/x509/20e72ede-78ef-460a-b843-68a35d994142"
      }
    }
  },
  "key": "certificates",
  "meta": {
    "first": "/api/configuration/management/certificates",
    "href": "/api/configuration/management/certificates",
    "last": "/api/configuration/management/webinterface",
    "next": "/api/configuration/management/disk_fillup_prevention",
    "parent": "/api/configuration/management",
    "previous": null,
    "transaction": "/api/transaction"
  }
}

Element			Type	Description
key			string	The ID of the endpoint.
body			Top level element (string)	Contains the internal certificates of SPS.
	ca		Top level item	Contains the certificate of SPS's internal Certificate Authority.
		selection	string	Must be set to identity.
		x509_identity	string	References the certificate of SPS's internal Certificate Authority. You can configure certificates at the /api/configuration/x509/ endpoint. To modify or add an X.509 certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key). For details, see Certificates stored on SPS.
	server		string	References the SSL certificate of SPS's web interface. You can configure certificates at the /api/configuration/x509/ endpoint. To modify or add an X.509 certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key). For details, see Certificates stored on SPS.
	tsa		string	References the certificate of SPS's internal Timestamping Authority. You can configure certificates at the /api/configuration/x509/ endpoint. To modify or add an X.509 certificate, use the value of the returned key as the value of the x509_identity element, and remove any child elements (including the key). For details, see Certificates stored on SPS.

Modify a certificate

To modify a certificate, you have to:

Open a transaction.

For details, see Open a transaction.
Create a CA

Have the value of the key element of a valid X.509 CA certificate stored on SPS.
Modify the JSON object of the endpoint.

Use the X.509 certificate's key as the value of the ca element. You can find a detailed description of the available parameters listed in Element . PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/management/certificates endpoint.
Commit your changes.

For details, see Commit a transaction.

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
201	Created	The new resource was successfully created.
401	Unauthenticated	The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
401	AuthenticationFailure	Authenticating the user with the given credentials has failed.
404	NotFound	The requested object does not exist.

Passwords stored on SPS

To create a new password, you have to POST the password or its hash as a JSON object to the https://<IP-address-of-SPS>/api/passwords endpoint. For details, see Create a new object. The body of the POST request must contain a JSON object with the parameters listed in Element . The response to a successful POST message is a JSON object that includes the reference ID of the created password in its key attribute. You can reference this ID in other parts of the configuration, for example, to set the password of a user account. Note that you can use a password object for only one purpose, that is, you cannot reference a password object twice.

URL

POST https://<IP-address-of-SPS>/api/configuration/passwords

Note that the GET method is not permitted on this endpoint, you cannot list the existing passwords. However, if you know the reference ID of a password, you can display its properties:
```
GET https://<IP-address-of-SPS>/api/configuration/passwords/<reference-ID-of-the-password;>
```
You cannot directly delete or modify a password, the DELETE and PUT methods are not permitted on password objects. To update a password, create a new one, then update the object that uses the old password to reference the new password.

Table 3: Headers
Header name	Description	Required	Values
Content-Type	Specifies the type of the data sent. SPS uses the JSON format	Required	application/json
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Sample request

The following command creates a new password object.

curl -X POST -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/passwords --data '{"plain": "newpassword"}'

If you do not want to include the actual password in the request, the SHA-256 hash of the password is enough:

curl -X POST -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/passwords --data '{"hash": "$6$rounds=5000$If20/EFyQ4dW3dg/$xrECLfXgZlC2Xr1s257E2aZen42fM7R.sOGG9pkPy1x5ORTx6j03oPWexVlB3f5wnaZOQCBF.NjlDgyg2WEe./"}'

Element	Type	Description
hash	string	Must contain the SHA-256 hash of the password to be created, for example, "hash": "ddec437eeb1da25a146a24c432d1165bc646daa7fecc6aa14c636265c83caa14". The request must contain at least the hash or the plain attribute.
nthash	string	Optional. Contains the NT-HASH of the password to be created, for example, "nthash": "2c01a73ad9e597f6eab0d072ed74616c"
plain	string	Contains the password in plain-text format, for example, "plain": "mypassword". The request must contain at least the hash or the plain attribute.

Response

The response to a successful POST message is a JSON object that includes the reference ID of the created password in its key attribute.

For details of the meta object, see Message format.

{
    "key": "faa96916-c85e-46ff-8697-f4cc5e596e7f",
    "meta": {
        "href": "/api/configuration/passwords/faa96916-c85e-46ff-8697-f4cc5e596e7f",
        "parent": "/api/configuration/passwords",
        "transaction": "/api/transaction"
    }
}

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
201	Created	The new resource was successfully created.
400	InvalidQuery	The requested filter or its value is invalid.
401	Unauthenticated	The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
401	AuthenticationFailure	Authenticating the user with the given credentials has failed.
404	NotFound	The requested object does not exist.
405	MethodNotAllowed	The method <method> is not allowed for this node.

Modify or delete password

You cannot directly delete or modify a password, the DELETE and PUT methods are not permitted on password objects. To update a password, create a new one, then update the object that uses the old password to reference the new password. After you commit the transaction, SPS will automatically delete the old password. For details, see Change the admin password.

Change the admin password

To change the password of the admin user, complete the following steps.

Open a transaction.

For details, see Open a transaction.
Create a new password object

POST a JSON object containing the password or the hash of the password to the https://<IP-address-of-SPS>/api/passwords endpoint. For details, see Element . For example:
```
curl -X POST -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/passwords --data '{"plain": "mypassword"}'
```
If the operation is successful, the response includes a reference key to the new password object.
Reference the key of the password in the user configuration.

Modify the JSON object of the user to reference the key of the new password object, and PUT the modified JSON object to the https://<IP-address-of-SPS>/api/configuration/aaa/local_database/users/<key-of-the-user> endpoint. For example:
```
curl -X PUT -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/aaa/local_database/users/14322374245a7de542bbb04 --data '{"name": "admin", "password": "<key-of-the-new-password>"}'
```
Commit your changes.

For details, see Commit a transaction.

Change the root password

To change the password of the root user, complete the following steps.

Open a transaction.

For details, see Open a transaction.
Create a new password object

POST a JSON object containing the password or the hash of the password to the https://<IP-address-of-SPS>/api/passwords endpoint. For details, see Element . For example:
```
curl -X POST -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/passwords --data '{"plain": "mypassword"}'
```
If the operation is successful, the response includes a reference key to the new password object.
Configure SPS to use this password for the root user configuration.

PUT the reference key of the new password object to the https://<IP-address-of-SPS>/api/configuration/management/root_password endpoint. For example:
```
curl -X PUT -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/management/root_password --data '"<key-of-the-new-password>"'
```
Note that you must PUT the reference key as a JSON string, enclosed in double-quotes.
Commit your changes.

For details, see Commit a transaction.

Private keys stored on SPS

To create a new private key, you have to POST the private key as a JSON object to the https://<IP-address-of-SPS>/api/private_keys endpoint. For details, see Create a new object. The body of the POST request must contain a JSON object with the parameters listed in Element . The response to a successful POST message is a JSON object that includes the reference ID of the created private key in its key attribute. You can reference this ID in other parts of the configuration. Note that you can use a private-key object for only one purpose, that is, you cannot reference one object twice.

URL

POST https://<IP-address-of-SPS>/api/configuration/private_keys

Note that the GET method is not permitted on this endpoint, you cannot list the existing private keys. However, if you know the reference ID of a private key, you can display its properties:
```
GET https://<IP-address-of-SPS>/api/configuration/private_keys/<reference-ID-of-the-private-key;>
```
You cannot directly delete or modify a private key, the DELETE and PUT methods are not permitted on private key objects. To update a private key, create a new one, then update the object that uses the old private key to reference the new private key.

Table 4: Headers
Header name	Description	Required	Values
Content-Type	Specifies the type of the data sent. SPS uses the JSON format	Required	application/json
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Sample request

The following command creates a new private key object. Note the following requirements:

The key must be in PKCS-1 PEM format.
Encrypted private keys are not supported.
The body of the POST message must be the private key as a single line, enclosed in double-quotes.
Replace line-breaks in the PEM file with \n

curl -X POST -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/private_keys --data "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END RSA PRIVATE KEY-----\n"

Querying a specific key returns the following information about the key:

curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/private_keys/<reference-ID-of-the-private-key;>

Element		Type	Description
public-key-fingerprint		string	The fingerprint of the public key that matches the private key.
	digest	string	The fingerprint of the key, for example ef:d3:8e:d0:81:4f:a2:8f:3b:8b:0c:dd:c7:8f:8c:7e
	hash_algorithm	string	The hash algorithm used to create the fingerprint, for example, sha256.
type	string	The type of the private key. Must be rsa

Response

The response to a successful POST message is a JSON object that includes the reference ID of the created public key in its key attribute.

For details of the meta object, see Message format.

{
    "key": "faa96916-c85e-46ff-8697-f4cc5e596e7f",
    "meta": {
        "href": "/api/configuration/private_keys/faa96916-c85e-46ff-8697-f4cc5e596e7f",
        "parent": "/api/configuration/private_keys",
        "transaction": "/api/transaction"
    }
}

The response to querying a specific key is a JSON object that includes the parameters of the key, for example:

{
    "body": {
        "public-key-fingerprint": {
            "digest": "ef:d3:8e:d0:81:4f:a2:8f:3b:8b:0c:dd:c7:8f:8c:7e",
            "hash_algorithm": "md5"
        },
        "type": "rsa"
    },
    "key": "6c4d1116-d79d-475b-bb37-9f844f085c14",
    "meta": {
        "first": "/api/configuration/private_keys/e5d13d18-07c5-43fa-89f4-c3d2ece17c71",
        "href": "/api/configuration/private_keys/6c4d1116-d79d-475b-bb37-9f844f085c14",
        "last": "/api/configuration/private_keys/6c4d1116-d79d-475b-bb37-9f844f085c14",
        "next": null,
        "parent": "/api/configuration/private_keys",
        "previous": "/api/configuration/private_keys/e5d13d18-07c5-43fa-89f4-c3d2ece17c71",
        "transaction": "/api/transaction"
    }

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
201	Created	The new resource was successfully created.
400	SyntacticError	Syntax error: Could not load PEM key: Unsupported private key format, only PKCS-1 is supported. Encrypted private keys are not supported.
401	Unauthenticated	The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
401	AuthenticationFailure	Authenticating the user with the given credentials has failed.
404	NotFound	The requested object does not exist.
405	MethodNotAllowed	The method <method> is not allowed for this node.

Modify or delete private key

You cannot directly delete or modify a private key, the DELETE and PUT methods are not permitted on private key objects. To update a private key, create a new one, then update the object that uses the old private key to reference the new private key. After you commit the transaction, SPS will automatically delete the old private key.

Certificates stored on SPS

To create a new certificate, you have to POST the certificate and its private key as a JSON object to the https://<IP-address-of-SPS>/api/x509 endpoint. For details, see Create a new object. The body of the POST request must contain a JSON object with the parameters listed in Element . The response to a successful POST message is a JSON object that includes the reference ID of the created certificate in its key attribute. You can reference this ID in other parts of the configuration. Note that you can use a certificate object for only one purpose, that is, you cannot reference one object twice.

URL

POST https://<IP-address-of-SPS>/api/configuration/x509

Note that the GET method is not permitted on this endpoint, you cannot list the existing certificates. However, if you know the reference ID of a certificate, you can display its properties:
```
GET https://<IP-address-of-SPS>/api/configuration/x509/<reference-ID-of-the-private-key;>
```
You cannot directly delete or modify a certificate, the DELETE and PUT methods are not permitted on certificate objects. To update a certificate, create a new one, then update the object that uses the old certificate to reference the new certificate.

Table 5: Headers
Header name	Description	Required	Values
Content-Type	Specifies the type of the data sent. SPS uses the JSON format	Required	application/json
session_id	Contains the authentication token of the user	Required	The value of the session ID cookie received from the REST server in the authentication response, for example, a1f71d030e657634730b9e887cb59a5e56162860. For details on authentication, see Authenticate to the SPS REST API.

Sample request

The following command creates a new certificate object. Note the following requirements:

The key must be in PKCS-1 PEM format.

You need the certificate and the private key as well.

Encrypted private keys are not supported.

The attributes of the POST message that contain the certificate and the private key must be a single line, enclosed in double-quotes.

Replace line-breaks in the PEM certificate with \n

The certificate and the certificate chain must be valid, SPS will reject invalid certificates and invalid certificate chains.

curl -X POST -H "Content-Type: application/json" --cookie cookies https://<IP-address-of-SPS>/api/configuration/x509 --data '{"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END RSA PRIVATE KEY-----\n"}'

The body should be:

{
    "certificate": "-----BEGIN CERTIFICATE-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END CERTIFICATE-----",
    "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END RSA PRIVATE KEY-----",
    "issuer_chain": []
}

Element	Type	Description
certificate		string	The certificate in PKCS-1 PEM format (replace line-breaks with \n). For example: -----BEGIN CERTIFICATE-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END CERTIFICATE-----
	private_key	string	The private key of the certificate, without encryption or password protection (replace line-breaks with \n). For example: -----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END RSA PRIVATE KEY-----
	issuer_chain	list	A comma-separated list of the Certificate Authority (CA) certificates that can be used to validate the uploaded certificate.

Element

Type

Description

certificate

string

The certificate in PKCS-1 PEM format (replace line-breaks with \n). For example:

-----BEGIN CERTIFICATE-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END CERTIFICATE-----

private_key

string

The private key of the certificate, without encryption or password protection (replace line-breaks with \n). For example:

-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAu3QMMhqeg9ZMLNfdvQoNN1deVRE2SR0VKY+ALnzPZF4fUoJy\n.....\nI2SchDibk/Xj/ZvuEQ23LvzayWOVVuVHtH3JZX3SU4Sa0vpaeC+3oddVTwQOWRq0\n ......... Qbn5W3xKz4vXDDQHEbEsvDQ9A7+uCEuHpO4s33IK9KEa0Zdp745AU0DSGXN4HFzc\n-----END RSA PRIVATE KEY-----

issuer_chain

list

A comma-separated list of the Certificate Authority (CA) certificates that can be used to validate the uploaded certificate.

Querying a specific key returns the following information about the key:

curl --cookie cookies https://<IP-address-of-SPS>/api/configuration/x509/<reference-ID-of-the-private-key;>

Element		Type	Description
fingerprint		string	The fingerprint of the certificate.
	digest	string	The fingerprint of the certificate, for example ef:d3:8e:d0:81:4f:a2:8f:3b:8b:0c:dd:c7:8f:8c:7e
	hash_algorithm	string	The hash algorithm used to create the fingerprint, for example, sha256.
subject	string	The subject string of the certificate.

Response

The response to a successful POST message is a JSON object that includes the reference ID of the created certificate in its key attribute.

For details of the meta object, see Message format.

{
    "key": "faa96916-c85e-46ff-8697-f4cc5e596e7f",
    "meta": {
        "href": "/api/configuration/x509/faa96916-c85e-46ff-8697-f4cc5e596e7f",
        "parent": "/api/configuration/x509",
        "transaction": "/api/transaction"
    }
}

The response to querying a specific certificate is a JSON object that includes the parameters of the certificate, for example:

{
    "body": {
        "fingerprint": {
            "digest": "ef:d3:8e:d0:81:4f:a2:8f:3b:8b:0c:dd:c7:8f:8c:7e",
            "hash_algorithm": "md5"
        },
        "subject": "C=RO/ST=State/L=Locality/O=Organization/OU=OrganizationalUnit/CN=example.com/emailAddress=root@example.com"
    },
    "key": "6c4d1116-d79d-475b-bb37-9f844f085c14",
    "meta": {
        "first": "/api/configuration/x509/e5d13d18-07c5-43fa-89f4-c3d2ece17c71",
        "href": "/api/configuration/x509/6c4d1116-d79d-475b-bb37-9f844f085c14",
        "last": "/api/configuration/x509/6c4d1116-d79d-475b-bb37-9f844f085c14",
        "next": null,
        "parent": "/api/configuration/x509",
        "previous": "/api/configuration/x509/e5d13d18-07c5-43fa-89f4-c3d2ece17c71",
        "transaction": "/api/transaction"
    }

Status and error codes

The following table lists the typical status and error codes for this request. For a complete list of error codes, see Application level error codes.

Code	Description	Notes
201	Created	The new resource was successfully created.
400	SyntacticError	Syntax error: Could not load PEM key: Unsupported private key format, only PKCS-1 is supported. Encrypted private keys are not supported.
401	Unauthenticated	The requested resource cannot be retrieved because the client is not authenticated and the resource requires authorization to access it. The details section contains the path that was attempted to be accessed, but could not be retrieved.
401	AuthenticationFailure	Authenticating the user with the given credentials has failed.
404	NotFound	The requested object does not exist.
405	MethodNotAllowed	The method <method> is not allowed for this node.

Modify or delete certificate

You cannot directly delete or modify a certificate, the DELETE and PUT methods are not permitted on certificate objects. To update a certificate, create a new one, then update the object that uses the old certificate to reference the new certificate. After you commit the transaction, SPS will automatically delete the old certificate.

One Identity Safeguard for Privileged Sessions 6.0.14 LTS - REST API Reference Guide

Internal certificates

URL

Cookies

Sample request

Response

Modify a certificate

Open a transaction.

Create a CA

Modify the JSON object of the endpoint.

Commit your changes.

Status and error codes

Passwords stored on SPS

URL

Sample request

Response

Status and error codes

Modify or delete password

Change the admin password

Open a transaction.

Create a new password object

Reference the key of the password in the user configuration.

Commit your changes.

Change the root password

Open a transaction.

Create a new password object

Configure SPS to use this password for the root user configuration.

Commit your changes.

Private keys stored on SPS

URL

Sample request

Response

Status and error codes

Modify or delete private key

Certificates stored on SPS

URL

Sample request

Response

Status and error codes

Modify or delete certificate

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

One Identity Safeguard for Privileged Sessions 6.0.14 LTS - REST API Reference Guide

Internal certificates

URL

Cookies

Sample request

Response

Modify a certificate

Open a transaction.

Create a CA

Modify the JSON object of the endpoint.

Commit your changes.

Status and error codes

Passwords stored on SPS

URL

Sample request

Response

Status and error codes

Modify or delete password

Change the admin password

Open a transaction.

Create a new password object

Reference the key of the password in the user configuration.

Commit your changes.

Change the root password

Open a transaction.

Create a new password object

Configure SPS to use this password for the root user configuration.

Commit your changes.

Private keys stored on SPS

URL

Sample request

Response

Status and error codes

Modify or delete private key

Certificates stored on SPS

URL

Sample request

Response

Status and error codes

Modify or delete certificate