{
  "openapi": "3.0.3",
  "info": {
    "title": "Independent PnC API",
    "version": "1.0.0",
    "description": "Standalone implementation of the public OPCP 1.0 route families, with local ISO 15118-20:2022 P-521 extensions. Not Hubject's commercial service or an interoperability certification. No SteVe dependency. Ed448/X448/TPM contract wrapping, ecosystem federation, HSM and external-CA online revocation validation are not implemented."
  },
  "servers": [
    {
      "url": "/",
      "description": "Direct routes; OPCP routes also accept /opcp and /hubject/opcp prefixes."
    }
  ],
  "security": [
    {
      "bearerAuth": []
    }
  ],
  "paths": {
    "/oauth/token": {
      "post": {
        "operationId": "post_oauth_token",
        "tags": [
          "OAuth"
        ],
        "summary": "Issue a one-hour access token",
        "description": "Allowed roles: registered client",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TokenRequest"
              }
            }
          }
        }
      }
    },
    "/v1/root/rootCerts": {
      "get": {
        "operationId": "get_v1_root_rootCerts",
        "tags": [
          "RCP"
        ],
        "summary": "List trusted roots",
        "description": "Allowed roles: any authenticated client",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      },
      "put": {
        "operationId": "put_v1_root_rootCerts",
        "tags": [
          "RCP"
        ],
        "summary": "Trust a self-signed root",
        "description": "Allowed roles: administrator session",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Root"
              }
            }
          }
        }
      }
    },
    "/v1/root/rootCerts/{rootCertificateId}": {
      "get": {
        "operationId": "get_v1_root_rootCerts__rootCertificateId_",
        "tags": [
          "RCP"
        ],
        "summary": "Read a root",
        "description": "Allowed roles: any authenticated client",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "rootCertificateId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      },
      "delete": {
        "operationId": "delete_v1_root_rootCerts__rootCertificateId_",
        "tags": [
          "RCP"
        ],
        "summary": "Remove a trusted root",
        "description": "Allowed roles: administrator session",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "rootCertificateId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/root/ctl": {
      "get": {
        "operationId": "get_v1_root_ctl",
        "tags": [
          "RCP"
        ],
        "summary": "Download a locally signed trust list",
        "description": "Local extension: CTL contains Base64 DER CMS SignedData with a JSON payload; OPCP 1.0 leaves the format unspecified. Requires a P-256/P-521 V2G root private key.\n\nAllowed roles: any authenticated client",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/oem/provCerts": {
      "put": {
        "operationId": "put_v1_oem_provCerts",
        "tags": [
          "PCP"
        ],
        "summary": "Register or replace an OEM provisioning chain",
        "description": "Allowed roles: OEM, OEM_with_V2G_PKI",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Provisioning"
              }
            }
          }
        }
      }
    },
    "/v1/oem/provCerts/{pcid}": {
      "get": {
        "operationId": "get_v1_oem_provCerts__pcid_",
        "tags": [
          "PCP"
        ],
        "summary": "Get an OEM provisioning chain",
        "description": "Allowed roles: OEM, MO and their PKI variants",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "pcid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      },
      "delete": {
        "operationId": "delete_v1_oem_provCerts__pcid_",
        "tags": [
          "PCP"
        ],
        "summary": "Delete an owned vehicle and revoke its local contracts",
        "description": "Allowed roles: owning OEM",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "pcid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/oem/provCerts/lookupVehicle/{pcid}": {
      "get": {
        "operationId": "get_v1_oem_provCerts_lookupVehicle__pcid_",
        "tags": [
          "PCP"
        ],
        "summary": "Check vehicle registration",
        "description": "Allowed roles: OEM, MO and their PKI variants",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "pcid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/cps/contractData/signed": {
      "put": {
        "operationId": "put_v1_cps_contractData_signed",
        "tags": [
          "CPS"
        ],
        "summary": "Sign externally encrypted contract data",
        "description": "PCID, when supplied, also stores the result in CCP. -20 extension uses P-521, a 133-byte uncompressed DH point and a 94-byte encrypted key (12-byte IV + 66-byte scalar + 16-byte GCM tag). -2 uses 65 / 48 bytes.\n\nAllowed roles: MO, MO_with_own_PKI",
        "responses": {
          "201": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SignedResponse"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SignRequest"
              }
            }
          }
        }
      }
    },
    "/v1/cps/signedContractData": {
      "put": {
        "operationId": "put_v1_cps_signedContractData",
        "tags": [
          "CPS"
        ],
        "summary": "Legacy sign without storing",
        "description": "Allowed roles: MO, MO_with_own_PKI",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SignedResponse"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "deprecated": true,
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SignRequest"
              }
            }
          }
        }
      }
    },
    "/v1/cps/forward/signedContractData": {
      "put": {
        "operationId": "put_v1_cps_forward_signedContractData",
        "tags": [
          "CPS"
        ],
        "summary": "Legacy sign and store",
        "description": "Allowed roles: MO, MO_with_own_PKI",
        "responses": {
          "201": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SignedResponse"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "deprecated": true,
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/SignRequest"
              }
            }
          }
        }
      }
    },
    "/v1/cps/generate/signedContractData": {
      "put": {
        "operationId": "put_v1_cps_generate_signedContractData",
        "tags": [
          "CPS"
        ],
        "summary": "Generate, encrypt, sign and store a contract",
        "description": "Allowed roles: MO, MO_without_PKI, MO_with_V2G_PKI",
        "responses": {
          "201": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SignedResponse"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/GenerateRequest"
              }
            }
          }
        }
      }
    },
    "/cps/signer": {
      "get": {
        "operationId": "get_cps_signer",
        "tags": [
          "CPS"
        ],
        "summary": "List active CPS signing certificate chains",
        "description": "Allowed roles: MO, MO_with_own_PKI, MO_without_PKI, CPS, CPO",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/ccp/signedContractData": {
      "post": {
        "operationId": "post_v1_ccp_signedContractData",
        "tags": [
          "CCP"
        ],
        "summary": "Validate a vehicle request and return EXI installation responses",
        "description": "Both supported versions return Base64 EXI. Malformed input without a usable session returns HTTP errors. No forwarding to external ecosystems is performed.\n\nAllowed roles: CPO",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InstallResponse"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          },
          {
            "name": "alwaysReturnEXI",
            "in": "header",
            "schema": {
              "type": "boolean",
              "default": true
            },
            "description": "For a structurally valid request, return an unsigned ISO failure response on certificate/contract validation failure. false uses HTTP errors. Success is always EXI."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/InstallRequest"
              }
            }
          }
        }
      },
      "put": {
        "operationId": "put_v1_ccp_signedContractData",
        "tags": [
          "CCP"
        ],
        "summary": "Verify and store signed Base64 XML",
        "description": "Allowed roles: CPS",
        "responses": {
          "201": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SignedResponse"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/StoreContract"
              }
            }
          }
        }
      }
    },
    "/v1/ccp/lookupContract/{emaid}": {
      "get": {
        "operationId": "get_v1_ccp_lookupContract__emaid_",
        "tags": [
          "CCP"
        ],
        "summary": "Look up contract certificates",
        "description": "Allowed roles: CPO, owning OEM/MO",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "emaid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/ccp/provideSignedContractData/{emaid}/{pcid}": {
      "get": {
        "operationId": "get_v1_ccp_provideSignedContractData__emaid___pcid_",
        "tags": [
          "CCP"
        ],
        "summary": "Get an offline EXI installation response",
        "description": "Allowed roles: owning OEM",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "emaid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "pcid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/v1/ccp/signedContractData/{pcid}/{emaid}/default": {
      "post": {
        "operationId": "post_v1_ccp_signedContractData__pcid___emaid__default",
        "tags": [
          "CCP"
        ],
        "summary": "Select the vehicle's default contract",
        "description": "Allowed roles: owning OEM",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "pcid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "emaid",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      }
    },
    "/.well-known/est/{ca}/simpleenroll/{iso-version}": {
      "post": {
        "operationId": "post__well_known_est__ca__simpleenroll__iso_version_",
        "tags": [
          "EST"
        ],
        "summary": "Enroll a PKCS#10 leaf CSR",
        "description": "ca: cpo, mo, oem, cps, veh. iso-version: 2 or 20. veh requires -20. Body is PEM, DER or Base64 DER. Response is Base64 DER PKCS#7 certs-only.\n\nAllowed roles: role matching ca",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/pkcs7-mime": {
                "schema": {
                  "type": "string",
                  "format": "byte"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "ca",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "iso-version",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/pkcs10": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            }
          }
        }
      }
    },
    "/{ca}/cacerts/{iso-version}/{algorithm}/": {
      "get": {
        "operationId": "get__ca__cacerts__iso_version___algorithm__",
        "tags": [
          "EST"
        ],
        "summary": "Get a CA chain",
        "description": "algorithm: secp256r1, secp521r1, ed448. Returns Base64 DER PKCS#7. Ed448 is supported for PKI management only, not contract wrapping.\n\nAllowed roles: role matching ca",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/pkcs7-mime": {
                "schema": {
                  "type": "string",
                  "format": "byte"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "ca",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "iso-version",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "algorithm",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ]
      }
    },
    "/v1/webhook/endpoints": {
      "get": {
        "operationId": "get_v1_webhook_endpoints",
        "tags": [
          "Webhooks"
        ],
        "summary": "Get webhook endpoint",
        "description": "HMAC-SHA256 delivery with X-PnC-Signature: t=<unix>,v1=<hex>; signs timestamp + '.' + raw body. Five total attempts. Public HTTPS destinations only. Secret returned once at creation.\n\nAllowed roles: authenticated client; own tenant only",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        }
      },
      "post": {
        "operationId": "post_v1_webhook_endpoints",
        "tags": [
          "Webhooks"
        ],
        "summary": "Post webhook endpoint",
        "description": "HMAC-SHA256 delivery with X-PnC-Signature: t=<unix>,v1=<hex>; signs timestamp + '.' + raw body. Five total attempts. Public HTTPS destinations only. Secret returned once at creation.\n\nAllowed roles: authenticated client; own tenant only",
        "responses": {
          "201": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Webhook"
              }
            }
          }
        }
      }
    },
    "/v1/webhook/endpoints/{id}": {
      "get": {
        "operationId": "get_v1_webhook_endpoints__id_",
        "tags": [
          "Webhooks"
        ],
        "summary": "Get webhook endpoint",
        "description": "HMAC-SHA256 delivery with X-PnC-Signature: t=<unix>,v1=<hex>; signs timestamp + '.' + raw body. Five total attempts. Public HTTPS destinations only. Secret returned once at creation.\n\nAllowed roles: authenticated client; own tenant only",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ]
      },
      "put": {
        "operationId": "put_v1_webhook_endpoints__id_",
        "tags": [
          "Webhooks"
        ],
        "summary": "Put webhook endpoint",
        "description": "HMAC-SHA256 delivery with X-PnC-Signature: t=<unix>,v1=<hex>; signs timestamp + '.' + raw body. Five total attempts. Public HTTPS destinations only. Secret returned once at creation.\n\nAllowed roles: authenticated client; own tenant only",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/Webhook"
              }
            }
          }
        }
      },
      "delete": {
        "operationId": "delete_v1_webhook_endpoints__id_",
        "tags": [
          "Webhooks"
        ],
        "summary": "Delete webhook endpoint",
        "description": "HMAC-SHA256 delivery with X-PnC-Signature: t=<unix>,v1=<hex>; signs timestamp + '.' + raw body. Five total attempts. Public HTTPS destinations only. Secret returned once at creation.\n\nAllowed roles: authenticated client; own tenant only",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ]
      }
    },
    "/ocsp": {
      "post": {
        "operationId": "post_ocsp",
        "tags": [
          "Revocation"
        ],
        "summary": "RFC 6960 status of locally managed certificates",
        "description": "Allowed roles: public",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/ocsp-response": {
                "schema": {
                  "type": "string",
                  "format": "binary"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [],
        "requestBody": {
          "required": true,
          "content": {
            "application/ocsp-request": {
              "schema": {
                "type": "string",
                "format": "binary"
              }
            }
          }
        }
      }
    },
    "/crl/{issuerId}": {
      "get": {
        "operationId": "get_crl__issuerId_",
        "tags": [
          "Revocation"
        ],
        "summary": "Download a signed DER CRL",
        "description": "Allowed roles: public",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/pkix-crl": {
                "schema": {
                  "type": "string",
                  "format": "binary"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "security": [],
        "parameters": [
          {
            "name": "issuerId",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ]
      }
    },
    "/v1/ccp/signedContractData/{identifier}": {
      "get": {
        "operationId": "get_v1_ccp_signedContractData__pcid_",
        "tags": [
          "CCP"
        ],
        "summary": "List contracts for an owned vehicle",
        "description": "Allowed roles: owning OEM",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "identifier",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "PCID for GET; EMAID for DELETE."
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          }
        ]
      },
      "delete": {
        "operationId": "delete_v1_ccp_signedContractData__emaid_",
        "tags": [
          "CCP"
        ],
        "summary": "Revoke and remove an owned contract",
        "description": "Allowed roles: owning MO and its PKI variants",
        "responses": {
          "200": {
            "description": "Success",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "default": {
            "description": "Request rejected",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          }
        },
        "parameters": [
          {
            "name": "identifier",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "PCID for GET; EMAID for DELETE."
          },
          {
            "name": "xsdMsgDefNamespace",
            "in": "query",
            "schema": {
              "type": "string",
              "enum": [
                "urn:iso:15118:2:2013:MsgDef",
                "urn:iso:std:iso:15118:-20:CommonMessages"
              ]
            },
            "description": "Disambiguates records present in both versions."
          },
          {
            "name": "X-Skip-Revocation",
            "in": "header",
            "schema": {
              "type": "boolean",
              "default": false
            },
            "description": "Only set true after an external issuing CA has revoked the certificate. Default revokes through the local CA."
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer",
        "bearerFormat": "JWT"
      }
    },
    "schemas": {
      "TokenRequest": {
        "type": "object",
        "properties": {
          "grant_type": {
            "type": "string",
            "enum": [
              "client_credentials"
            ]
          },
          "client_id": {
            "type": "string"
          },
          "client_secret": {
            "type": "string"
          },
          "audience": {
            "type": "string"
          }
        },
        "required": [
          "grant_type",
          "client_id",
          "client_secret",
          "audience"
        ]
      },
      "Root": {
        "type": "object",
        "properties": {
          "rootType": {
            "type": "string",
            "enum": [
              "V2G",
              "MO",
              "OEM",
              "PE"
            ]
          },
          "caCertificate": {
            "type": "string",
            "format": "byte"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          }
        },
        "required": [
          "rootType",
          "caCertificate"
        ]
      },
      "Provisioning": {
        "type": "object",
        "properties": {
          "vehicleCertificate": {
            "type": "string",
            "format": "byte"
          },
          "subCA1Certificate": {
            "type": "string",
            "format": "byte"
          },
          "subCA2Certificate": {
            "type": "string",
            "format": "byte"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          },
          "previousPcid": {
            "type": "string"
          },
          "v2gRootAuthorityKeyIdentifiers": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        },
        "required": [
          "vehicleCertificate",
          "subCA1Certificate"
        ]
      },
      "WrappedContract": {
        "type": "object",
        "properties": {
          "contractCertificate": {
            "type": "string",
            "format": "byte"
          },
          "contractSubCa1Certificate": {
            "type": "string",
            "format": "byte"
          },
          "contractSubCa2Certificate": {
            "type": "string",
            "format": "byte"
          },
          "contractSignatureEncryptedPrivateKey": {
            "type": "string",
            "format": "byte"
          },
          "dHpublickey": {
            "type": "string",
            "format": "byte"
          }
        },
        "required": [
          "contractCertificate",
          "contractSubCa1Certificate",
          "contractSignatureEncryptedPrivateKey",
          "dHpublickey"
        ]
      },
      "SignRequest": {
        "type": "object",
        "properties": {
          "contractData": {
            "$ref": "#/components/schemas/WrappedContract"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          },
          "pcid": {
            "type": "string"
          },
          "profileId": {
            "type": "string"
          },
          "cpsV2GRootCertificateFingerprint": {
            "type": "string"
          }
        },
        "required": [
          "contractData",
          "xsdMsgDefNamespace"
        ]
      },
      "GenerateRequest": {
        "type": "object",
        "properties": {
          "emaid": {
            "type": "string"
          },
          "pcid": {
            "type": "string"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          },
          "contractBegins": {
            "type": "string",
            "format": "date-time"
          },
          "contractEnds": {
            "type": "string",
            "format": "date-time"
          },
          "profileId": {
            "type": "string"
          },
          "cpsV2GRootCertificateFingerprint": {
            "type": "string"
          },
          "metaData": {
            "type": "string"
          }
        },
        "required": [
          "emaid",
          "pcid",
          "xsdMsgDefNamespace",
          "contractBegins",
          "contractEnds"
        ]
      },
      "StoreContract": {
        "type": "object",
        "properties": {
          "emaid": {
            "type": "string"
          },
          "pcid": {
            "type": "string"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          },
          "signedContractDataXML": {
            "type": "string",
            "format": "byte"
          },
          "metadata": {
            "type": "string"
          },
          "cpsV2GRootCertificateFingerprint": {
            "type": "string"
          }
        },
        "required": [
          "emaid",
          "pcid",
          "xsdMsgDefNamespace",
          "signedContractDataXML"
        ]
      },
      "InstallRequest": {
        "type": "object",
        "properties": {
          "certificateInstallationReq": {
            "type": "string",
            "format": "byte"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          }
        },
        "required": [
          "certificateInstallationReq",
          "xsdMsgDefNamespace"
        ]
      },
      "InstallResponse": {
        "type": "object",
        "properties": {
          "CCPResponse": {
            "type": "object",
            "properties": {
              "emaidContent": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "messageDef": {
                      "type": "object",
                      "properties": {
                        "certificateInstallationRes": {
                          "type": "string",
                          "format": "byte"
                        },
                        "emaid": {
                          "type": "string"
                        },
                        "metaData": {
                          "type": "string"
                        },
                        "cpsV2GRootCertificateFingerprint": {
                          "type": "string"
                        }
                      },
                      "required": [
                        "certificateInstallationRes"
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      },
      "SignedResponse": {
        "type": "object",
        "properties": {
          "emaid": {
            "type": "string"
          },
          "pcid": {
            "type": "string"
          },
          "xsdMsgDefNamespace": {
            "type": "string",
            "enum": [
              "urn:iso:15118:2:2013:MsgDef",
              "urn:iso:std:iso:15118:-20:CommonMessages"
            ]
          },
          "signedData": {
            "type": "string",
            "format": "byte"
          },
          "cpsV2GRootCertificateFingerprint": {
            "type": "string"
          },
          "cpsRootDistinguishedName": {
            "type": "string"
          },
          "metaData": {
            "type": "string"
          }
        }
      },
      "Webhook": {
        "type": "object",
        "properties": {
          "url": {
            "type": "string",
            "format": "uri"
          },
          "enabledEvents": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "status": {
            "type": "string",
            "enum": [
              "enabled",
              "disabled"
            ]
          },
          "metadata": {
            "type": "object"
          }
        },
        "required": [
          "url",
          "enabledEvents"
        ]
      },
      "Error": {
        "type": "object",
        "properties": {
          "errorMessages": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "traceId": {
            "type": "string"
          }
        }
      }
    }
  }
}
