Who holds an enrollment's service account

GET

/api/certs/service/enrollments/{id}/holders

curl --request GET \
  --url https://example.com/api/certs/service/enrollments/example/holders \
  --header 'X-Ssoossh-Key-Secret: <X-Ssoossh-Key-Secret>'

Everyone who can see and manage this enrollment code, which is everyone holding its service account — a code belongs to its account rather than to whoever approved it, so this is the only place that answers “who else has this”.

Only users the server has a row for appear – those who have logged in at least once, or whom the directory sync has seen – holding the accounts that record last reported: the server never enumerates a directory, so this is everyone known to hold the account rather than everyone who does.

Visible to auditors and to the account’s own holders.

Authorizations

• sessionCookie

Parameters

Path Parameters

id

required

string

The enrollment’s UUID

Responses

200

The account’s known holders

Media typeapplication/json

object

data

required

object

holders

required

Array<object>

object

disabled

Disabled marks a holder whose account is disabled. Listed rather than omitted: the claim is still on their row and comes back with the account, so dropping them would answer “who has access” with a set that quietly grows again later.

boolean

email

string

name

Name and Email are display fields, empty when the identity provider released neither.

string

own

Own marks a holder for whom this is their own account rather than one a service_accounts claim named — only possible with cert_options.service.allow_user_accounts on.

boolean

user_id

required

string

username

required

string

service_account

required

ServiceAccount is the account the holders were resolved for, echoed back so the panel can name it without re-deriving it from principals.

string

error

string

Example ^generated

{
  "data": {
    "holders": [
      {
        "disabled": true,
        "email": "example",
        "name": "example",
        "own": true,
        "user_id": "example",
        "username": "example"
      }
    ],
    "service_account": "example"
  },
  "error": "example"
}

401

No valid session

Media typeapplication/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

403

Not a holder of the service account

Media typeapplication/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}

404

No such enrollment

Media typeapplication/json

object

data

Data is always null on an error response.

error

required

Error is a human-readable message. Branch on the HTTP status rather than this string; it is for humans and logs.

string

error_code

required

ErrorCode is a machine-readable error classifier. One of the error_code constants from internal/apitypes; use this to decide whether to retry or branch on the failure mode.

string

Example

{
  "error": "certificate request \"9f1c…\" not found",
  "error_code": "not_found"
}