openapi: 3.0.3
info:
  title: Check certificate
  version: 1.0.5
  description: API designed to permit verification of certificates and certification authorities

servers:
  - description: Qual
    url: https://api.cashmanagement.staging.bnpparibas
  - description: Prod
    url: https://api.cashmanagement.group.echonet

security:
  - ApiKeyAuth: [] # use the same name as under securitySchemes

paths:
  /v1/certificate/check:
   post:
     summary: Check certificate
     tags: 
      - Certificates
     operationId: Camt
     parameters:
        - $ref: '#/components/parameters/requestId'
     requestBody:
        description: TODO
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RequestCertificateCheck"
     

     responses:
       '200':
         description: Technical processing of responses result
         content:
           application/json:
             schema:
               $ref: '#/components/schemas/ResponseCertificateCheck'
             examples: 
              responseOK:
                $ref: '#/components/examples/response_OK'
              responseKO:
                $ref: '#/components/examples/response_KO'
              responsePartial:
                $ref: '#/components/examples/response_partial'
       '400':
          description: Request failure
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Erreur'
       '401':
          description: 'Unauthorized, authentication failure.'
          content:
            application/json; charset=utf-8:
              schema:
                $ref: '#/components/schemas/Erreur'
          headers:
            TraceId:
              schema:
                type: string
       "403":
          description: |
            Forbidden.
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/Erreur"
       '404':
          description: Unknown transaction
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Erreur'
       '500':
          description: internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Erreur'

components:
       
  parameters:
      requestId:
        in: header
        name: x-request-id
        description: API Consumer request ID
        required: false
        schema:
          type: string
          format: uuid

  schemas:
    RequestCertificateCheck:
      type: object
      required: 
        - type
        - base64PublicCertificate
      properties:
        type:
           description: Certificate type
           type: string
           pattern: '^(SSL|DIGITAL_SIGNATURE)$'
           example: 'SSL'
        base64PublicCertificate:
           description: Public certificate crt file encoded in base 64 to check
           type: string
           example: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUdZVENDQlVtZ0F3SUJBZ0lEQmFVZk1BMEdDU3FHU0liM0RRRUJDd1VBTUZ3eERqQU1CZ05WQkFvVEJVZHkKYjNWd01SVXdFd1lEVlFRTEV3eEJVRkJNU1VOQlZFbFBUbE14RFRBTEJnTlZCQXNUQkdsUVMwa3hKREFpQmdOVgpCQU1UR3pJd01UUXRNakF5T1NCQ1RsQlFJRUZ3Y0d4cFkyRjBhVzl1Y3pBZUZ3MHlOREEzTWpVeE5UUXlNRE5hCkZ3MHlOakEzTWpVeE5UUTNNRE5hTUVveERqQU1CZ05WQkFvTUJVZHliM1Z3TVJVd0V3WURWUVFMREF4QmNIQnMKYVdOaGRHbHZibk14SVRBZkJnTlZCQU1NR0c1bGQyTXRZWEJwTG5OMFlXZHBibWN1WldOb2IyNWxkRENDQVNJdwpEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBS0dqdGZxZ3VJU1Q2UHBhYnpmdDhNTnRuZEhnCjZhaTdlSUczcnVka2xYd05OcllCWFdHN1Z2ckU0bjd5VWlVNFFhVVo2bjI1c1pNNWMvTW9McHZkU2hOcmlqeTUKdlFURkMrUW45UW1aN3NRTUw5NFcrVjMwZllrRlpaaFdTT0htUzlLd0NLem5rTXdjaUhUQnlZbm8yZmVlOVU5QgpVYzB4TVdZaG5CUHBhd1k5N0UzS1VGTE1ISWpsMnJDa1M4MHdwTFZRYmNUQTY4Ri9tN2k1SC82R1VSR2c0MFZtCm5rbGVUU3ZRTUsyWlZLSWJ6M21WTVRzZk13Z2RDdVBxWUxhd0xoaWtFRElxWDdIZFFIOW51QmVsOGg4aDRQOG0KRlhXZXlyTmVzRFlmWDNrdld3ZlhlRXRCSStxbjdWVlBURUNRdjR5dXRDdWViZUNkUDllTzY1THZUSDBDQXdFQQpBYU9DQXp3d2dnTTRNQjBHQTFVZERnUVdCQlJyUjhPdlk4Q0diVUozWHQvZUZ1Ymp6NnZDdGpBZkJnTlZIU01FCkdEQVdnQlMzTkxXbzUrNGFVTWs5ZTZzM2p4dVpyay80OXpBWEJnTlZIU0FFRURBT01Bd0dDaXFCZWdFK0JBR0MKTVFFd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3SUdDQ3NHQVFVRkJ3TUJNQTRHQTFVZER3RUIvd1FFQXdJRgpvREJ6QmdOVkhSRUViREJxZ2hodVpYZGpMV0Z3YVM1emRHRm5hVzVuTG1WamFHOXVaWFNDR1hNd01YWnNPVGt4Ck1qYzNPQzV1WlhRdVpuSXVhVzUwY21HQ0dYTXdNWFpzT1RreE1qYzNPUzV1WlhRdVpuSXVhVzUwY21HQ0dHNWwKZDJNdFlYQnBMbk4wWVdkcGJtY3VaV05vYjI1bGREQ0NBZDhHQTFVZEh3U0NBZFl3Z2dIU01EbWdONkExaGpObwpkSFJ3T2k4dmFYQnJhUzFqY213dVozSnZkWEF1WldOb2IyNWxkQzlDVGxCUVgwRndjR3hwWTJGMGFXOXVjeTVqCmNtd3dnWldnZ1pLZ2dZK0dnWXhzWkdGd09pOHZhWEJyYVMxeVpXWnpaeTVuY205MWNDNWxZMmh2Ym1WME9qTTQKT1M5RFRqMHlNREUwTFRJd01qa2xNakJDVGxCUUpUSXdRWEJ3YkdsallYUnBiMjV6TEU5VlBXbFFTMGtzVDFVOQpRVkJRVEVsRFFWUkpUMDVUTEU4OVIzSnZkWEEvWTJWeWRHbG1hV05oZEdWU1pYWnZZMkYwYVc5dVRHbHpkRHRpCmFXNWhjbmsvWW1GelpUQ0J2NkNCdktDQnVZYUJ0bXhrWVhBNkx5OHZRMDQ5TWpBeE5DMHlNREk1SlRJd1FrNVEKVUNVeU1FRndjR3hwWTJGMGFXOXVjeXhEVGoweU1ERTBMVEl3TWprbE1qQkNUbEJRSlRJd1FYQndiR2xqWVhScApiMjV6TEVOT1BVTkVVQ3hEVGoxUWRXSnNhV01sTWpCTFpYa2xNakJUWlhKMmFXTmxjeXhEVGoxVFpYSjJhV05sCmN5eERUajFEYjI1bWFXZDFjbUYwYVc5dUxFUkRQVzVsZEN4RVF6MXBiblJ5WVQ5alpYSjBhV1pwWTJGMFpWSmwKZG05allYUnBiMjVNYVhOME1EdWdPYUEzaGpWb2RIUndPaTh2YVhCcmFTNWlibkJ3WVhKcFltRnpaM0p2ZFhBdQpZMjl0TDBKT1VGQmZRWEJ3YkdsallYUnBiMjV6TG1OeWJEQldCZ2dyQmdFRkJRY0JBUVJLTUVnd1JnWUlLd1lCCkJRVUhNQUdHT21oMGRIQTZMeTlwY0d0cExXOWpjM0F1WjNKdmRYQXVaV05vYjI1bGRDOHlNREUwTFRJd01qa3QKUWs1UVVDMUJjSEJzYVdOaGRHbHZibk13RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUltcXBQRnQwdWFMUjdlTgpuMHR4K001bTNBaTI4ZUk1Y3RiOVY5VEdzY2p6TkhvMFN5Tk5BS2prZDV1aCtkMWZOMHBxUlF2TTlsckRpU09uClpKeWpkaE9NYlpsSlMvYzYxT0RvWS94ek5nYnJhLy9Odm1FSGhZczR0UFRkSnRPMGhBSjB2Y2Z4NDVLcFNDTHMKek5QM1lEbG4vd0Y3aVN1SzJnamNyQ2ZEczJMM3lCNThlVEU5S0UzQTFiNEtBNEpEOVZlVDhWN1dUbzhBWkVwRApDanZGUm82bktadnpnUnp1TGJLcmx2ODhoRTZDRkhYMjlBcE4vSklVYmRTVU96UDNIRjA2OEpFeU9zY2RtZXhjClZwMUwvV2psamNOKzdVQUZ6ZUhxYVZTKzlXT3l2MXFvK0Rsbk15ZHN1anVDMXZnaGtOS3JRZGxwZ1diNFVUVW0KQ25MQTUybz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo
    ResponseCertificateCheck:
      type: object
      required: 
        - statusCode
      properties:
        statusCode:
          description: Status code
          type: string
          example: OK, KO, PARTIAL
        controls:
          type: array
          items:
            $ref: '#/components/schemas/ResponseCertificateControl'
        revocationVerificationType:
           description: type of verification of revocation
           type: string
        commonName:
           description: Common Name
           type: string
        issueDate:
           description: issue date
           format: date-time
        expirationDate:
           description: expiration date
           format: date-time
        parentAuthorityCertificateName:
           description: parent authority certificate name
           type: string
        algorithm:
           description: algorithm
           type: string
        fingerPrint:
           description: fingerPrint
           type: string
        keySize:
           description: size of the key
           type: integer
    ResponseCertificateControl:
      type: object
      properties:
        key:
          description: Key
          type: string
        value:
          description: Value
          type: string
    ApiKey:
        description : Unique identifier for a client.
        type: string
        format: string
        example: "x-api-key"

    Erreur:
      type: object
      properties:
        code:
          type: integer
          description: HTTP error code
        message:
          type: string
          description: Message of Error
        description:
          type: string
          description: Description of Error
  examples:
    response_OK:
      summary: response OK
      value:
        statusCode: 'OK'
        controls: [
          {
            key: 'ValidityPeriod',
            value: 'OK'
          },{
            key: 'CheckChainCertificate',
            value: 'OK'
          },{
            key: 'NotRevokedCertificate',
            value: 'OK'
          }
        ]
        revocationVerificationType: 'OSCP'
        commonName: 'api.cashmanagement.bnpparibas'
        issueDate: '2025-03-05T13:54:25.448Z'
        expirationDate: '2025-03-05T13:54:25.448Z'
        parentAuthorityCertificateName: 'Entrust Certification Authority - L1M'
        algorithm: 'sha256RSA'
        fingerPrint: '890d162dfafbe894962fbd56e4b155a4aef45dcf'
        keySize: 2048
    response_KO:
      summary: response KO
      value:
        statusCode: 'KO'
        controls: [
          {
            key: 'ValidityPeriod',
            value: 'KO'
          },{
            key: 'CheckChainCertificate',
            value: 'OK'
          },{
            key: 'NotRevokedCertificate',
            value: 'KO'
          }
        ]
        revocationVerificationType: 'OSCP'
        commonName: 'api.cashmanagement.bnpparibas'
        issueDate: '2025-03-05T13:54:25.448Z'
        expirationDate: '2025-03-05T13:54:25.448Z'
        parentAuthorityCertificateName: 'Entrust Certification Authority - L1M'
        algorithm: 'sha256RSA'
        fingerPrint: '890d162dfafbe894962fbd56e4b155a4aef45dcf'
        keySize: 2048
    response_partial:
      summary: response PARTIAL
      value:
        statusCode: 'PARTIAL'
        controls: [
          {
            key: 'ValidityPeriod',
            value: 'OK'
          },{
            key: 'CheckChainCertificate',
            value: 'OK'
          },{
            key: 'NotRevokedCertificate',
            value: 'UNKNOWN'
          }
        ]
        revocationVerificationType: 'OSCP'
        commonName: 'api.cashmanagement.bnpparibas'
        issueDate: '2025-03-05T13:54:25.448Z'
        expirationDate: '2025-03-05T13:54:25.448Z'
        parentAuthorityCertificateName: 'Entrust Certification Authority - L1M'
        algorithm: 'sha256RSA'
        fingerPrint: '890d162dfafbe894962fbd56e4b155a4aef45dcf'
        keySize: 2048

  securitySchemes:
    ApiKeyAuth: # arbitrary name for the security scheme
      type: apiKey
      in: header # can be "header", "query" or "cookie"
      name: x-api-key # name of the header, query parameter or cookie