Package co.ankatech.keymanagement.client.keymanagement.api

Class InternalCryptoUseCasesApi

java.lang.Object
co.ankatech.keymanagement.client.keymanagement.api.InternalCryptoUseCasesApi
public class InternalCryptoUseCasesApi extends Object

  • Constructor Details

    • InternalCryptoUseCasesApi

      public InternalCryptoUseCasesApi()

    • InternalCryptoUseCasesApi

      public InternalCryptoUseCasesApi(ApiClient apiClient)

  • Method Details

    • getApiClient

      public ApiClient getApiClient()

    • setApiClient

      public void setApiClient(ApiClient apiClient)

    • getHostIndex

      public int getHostIndex()

    • setHostIndex

      public void setHostIndex(int hostIndex)

    • getCustomBaseUrl

      public String getCustomBaseUrl()

    • setCustomBaseUrl

      public void setCustomBaseUrl(String customBaseUrl)

    • createInternalCryptoUseCaseCall

      public okhttp3.Call createInternalCryptoUseCaseCall(@Nonnull UUID tenantId, @Nonnull CreateInternalCryptoUseCaseRequest createInternalCryptoUseCaseRequest, ApiCallback _callback) throws ApiException
      Build call for createInternalCryptoUseCase
      Parameters:
      tenantId - Tenant UUID (required)
      createInternalCryptoUseCaseRequest - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • createInternalCryptoUseCase

      public InternalCryptoUseCaseResponse createInternalCryptoUseCase(@Nonnull UUID tenantId, @Nonnull CreateInternalCryptoUseCaseRequest createInternalCryptoUseCaseRequest) throws ApiException
      Provision an internal crypto use case Composes an authorization overlay over keys that <b>already exist</b>, for the calling application's self-use scenario. Atomically creates the control-plane entities — Exchange Context (INTERNAL) + Actor (INTERNAL) + Credential + Asset references + Constraint Policy (permissive) + 1..N Capability Grants. <b>This endpoint creates no key.</b> <code>keyKid</code> and <code>targetKeyKid</code> are references to keys the tenant already owns; provision keys with <code>POST /api/v3/admin/tenants/{tenantId}/keys</code> (scope <code>admin.keys.orchestrate</code>) and name them here. The key keeps its own lifecycle: revoking or deleting this use case leaves it untouched, and several use cases may reference one key. A use case declaring <code>CONVERT_PKCS7_TO_JOSE</code> names its keys in <code>pkcs7Conversion</code> — the opener, the other recipients and the signers — and receives exactly the grants the conversion asks for: one <code>REENCRYPT</code> <code>[openerKid, recipient]</code> per other recipient (an in-place <code>REENCRYPT [openerKid]</code> when the opener is the sole recipient) and one <code>RESIGN [signer]</code> per signer. A signers-only use case converts <code>SignedData</code>; <code>ANALYZE_PKCS7</code> needs no key. A key reference that names no key in the tenant is <b>404</b>. A key that exists but cannot carry the declared operations is <b>422</b>, with a distinct <code>type</code> per cause. Every refusal happens <b>before</b> anything is provisioned, so a rejected request creates nothing. The credential plaintext is returned ONCE in the 201 response body — capture it immediately. Scope required: <code>admin.tenant.internal-use-case.create</code>
      Parameters:
      tenantId - Tenant UUID (required)
      createInternalCryptoUseCaseRequest - (required)
      Returns:
      InternalCryptoUseCaseResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • createInternalCryptoUseCaseWithHttpInfo

      public ApiResponse<InternalCryptoUseCaseResponse> createInternalCryptoUseCaseWithHttpInfo(@Nonnull UUID tenantId, @Nonnull CreateInternalCryptoUseCaseRequest createInternalCryptoUseCaseRequest) throws ApiException
      Provision an internal crypto use case Composes an authorization overlay over keys that <b>already exist</b>, for the calling application's self-use scenario. Atomically creates the control-plane entities — Exchange Context (INTERNAL) + Actor (INTERNAL) + Credential + Asset references + Constraint Policy (permissive) + 1..N Capability Grants. <b>This endpoint creates no key.</b> <code>keyKid</code> and <code>targetKeyKid</code> are references to keys the tenant already owns; provision keys with <code>POST /api/v3/admin/tenants/{tenantId}/keys</code> (scope <code>admin.keys.orchestrate</code>) and name them here. The key keeps its own lifecycle: revoking or deleting this use case leaves it untouched, and several use cases may reference one key. A use case declaring <code>CONVERT_PKCS7_TO_JOSE</code> names its keys in <code>pkcs7Conversion</code> — the opener, the other recipients and the signers — and receives exactly the grants the conversion asks for: one <code>REENCRYPT</code> <code>[openerKid, recipient]</code> per other recipient (an in-place <code>REENCRYPT [openerKid]</code> when the opener is the sole recipient) and one <code>RESIGN [signer]</code> per signer. A signers-only use case converts <code>SignedData</code>; <code>ANALYZE_PKCS7</code> needs no key. A key reference that names no key in the tenant is <b>404</b>. A key that exists but cannot carry the declared operations is <b>422</b>, with a distinct <code>type</code> per cause. Every refusal happens <b>before</b> anything is provisioned, so a rejected request creates nothing. The credential plaintext is returned ONCE in the 201 response body — capture it immediately. Scope required: <code>admin.tenant.internal-use-case.create</code>
      Parameters:
      tenantId - Tenant UUID (required)
      createInternalCryptoUseCaseRequest - (required)
      Returns:
      ApiResponse<InternalCryptoUseCaseResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • createInternalCryptoUseCaseAsync

      public okhttp3.Call createInternalCryptoUseCaseAsync(@Nonnull UUID tenantId, @Nonnull CreateInternalCryptoUseCaseRequest createInternalCryptoUseCaseRequest, ApiCallback<InternalCryptoUseCaseResponse> _callback) throws ApiException
      Provision an internal crypto use case (asynchronously) Composes an authorization overlay over keys that <b>already exist</b>, for the calling application's self-use scenario. Atomically creates the control-plane entities — Exchange Context (INTERNAL) + Actor (INTERNAL) + Credential + Asset references + Constraint Policy (permissive) + 1..N Capability Grants. <b>This endpoint creates no key.</b> <code>keyKid</code> and <code>targetKeyKid</code> are references to keys the tenant already owns; provision keys with <code>POST /api/v3/admin/tenants/{tenantId}/keys</code> (scope <code>admin.keys.orchestrate</code>) and name them here. The key keeps its own lifecycle: revoking or deleting this use case leaves it untouched, and several use cases may reference one key. A use case declaring <code>CONVERT_PKCS7_TO_JOSE</code> names its keys in <code>pkcs7Conversion</code> — the opener, the other recipients and the signers — and receives exactly the grants the conversion asks for: one <code>REENCRYPT</code> <code>[openerKid, recipient]</code> per other recipient (an in-place <code>REENCRYPT [openerKid]</code> when the opener is the sole recipient) and one <code>RESIGN [signer]</code> per signer. A signers-only use case converts <code>SignedData</code>; <code>ANALYZE_PKCS7</code> needs no key. A key reference that names no key in the tenant is <b>404</b>. A key that exists but cannot carry the declared operations is <b>422</b>, with a distinct <code>type</code> per cause. Every refusal happens <b>before</b> anything is provisioned, so a rejected request creates nothing. The credential plaintext is returned ONCE in the 201 response body — capture it immediately. Scope required: <code>admin.tenant.internal-use-case.create</code>
      Parameters:
      tenantId - Tenant UUID (required)
      createInternalCryptoUseCaseRequest - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • deleteInternalCryptoUseCaseCall

      public okhttp3.Call deleteInternalCryptoUseCaseCall(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nullable String reason, ApiCallback _callback) throws ApiException
      Build call for deleteInternalCryptoUseCase
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      reason - (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • deleteInternalCryptoUseCase

      public void deleteInternalCryptoUseCase(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nullable String reason) throws ApiException
      Revoke a use case (terminal) Transitions ACTIVE/SUSPENDED → REVOKED with the terminal cause OPERATOR_REVOKED. Soft-deletes the aggregate; audit history preserved, and the revoked use case stays readable through GET and through the list with status=REVOKED. A second DELETE of an already-REVOKED use case answers 404, like every other lifecycle verb on it: the use case is no longer live, and its first cause is kept. Scope: admin.tenant.internal-use-case.revoke
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      reason - (optional)
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • deleteInternalCryptoUseCaseWithHttpInfo

      public ApiResponse<Void> deleteInternalCryptoUseCaseWithHttpInfo(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nullable String reason) throws ApiException
      Revoke a use case (terminal) Transitions ACTIVE/SUSPENDED → REVOKED with the terminal cause OPERATOR_REVOKED. Soft-deletes the aggregate; audit history preserved, and the revoked use case stays readable through GET and through the list with status=REVOKED. A second DELETE of an already-REVOKED use case answers 404, like every other lifecycle verb on it: the use case is no longer live, and its first cause is kept. Scope: admin.tenant.internal-use-case.revoke
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      reason - (optional)
      Returns:
      ApiResponse<Void>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • deleteInternalCryptoUseCaseAsync

      public okhttp3.Call deleteInternalCryptoUseCaseAsync(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nullable String reason, ApiCallback<Void> _callback) throws ApiException
      Revoke a use case (terminal) (asynchronously) Transitions ACTIVE/SUSPENDED → REVOKED with the terminal cause OPERATOR_REVOKED. Soft-deletes the aggregate; audit history preserved, and the revoked use case stays readable through GET and through the list with status=REVOKED. A second DELETE of an already-REVOKED use case answers 404, like every other lifecycle verb on it: the use case is no longer live, and its first cause is kept. Scope: admin.tenant.internal-use-case.revoke
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      reason - (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • getInternalCryptoUseCaseCall

      public okhttp3.Call getInternalCryptoUseCaseCall(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, ApiCallback _callback) throws ApiException
      Build call for getInternalCryptoUseCase
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • getInternalCryptoUseCase

      public InternalCryptoUseCaseResponse getInternalCryptoUseCase(@Nonnull UUID tenantId, @Nonnull UUID useCaseId) throws ApiException
      Get internal crypto use case detail Returns the aggregate with all 7 child entity references, in any state: a REVOKED use case is returned with the members that say why it ended. Cross-tenant probe → 404 oracle-safe (NOT 403). credential.clientSecret is OMITTED from the JSON response (only present on 201 create). Scope: admin.tenant.internal-use-case.read
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      Returns:
      InternalCryptoUseCaseResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • getInternalCryptoUseCaseWithHttpInfo

      public ApiResponse<InternalCryptoUseCaseResponse> getInternalCryptoUseCaseWithHttpInfo(@Nonnull UUID tenantId, @Nonnull UUID useCaseId) throws ApiException
      Get internal crypto use case detail Returns the aggregate with all 7 child entity references, in any state: a REVOKED use case is returned with the members that say why it ended. Cross-tenant probe → 404 oracle-safe (NOT 403). credential.clientSecret is OMITTED from the JSON response (only present on 201 create). Scope: admin.tenant.internal-use-case.read
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      Returns:
      ApiResponse<InternalCryptoUseCaseResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • getInternalCryptoUseCaseAsync

      public okhttp3.Call getInternalCryptoUseCaseAsync(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, ApiCallback<InternalCryptoUseCaseResponse> _callback) throws ApiException
      Get internal crypto use case detail (asynchronously) Returns the aggregate with all 7 child entity references, in any state: a REVOKED use case is returned with the members that say why it ended. Cross-tenant probe → 404 oracle-safe (NOT 403). credential.clientSecret is OMITTED from the JSON response (only present on 201 create). Scope: admin.tenant.internal-use-case.read
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • listInternalCryptoUseCasesCall

      public okhttp3.Call listInternalCryptoUseCasesCall(@Nonnull UUID tenantId, @Nullable String status, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort, ApiCallback _callback) throws ApiException
      Build call for listInternalCryptoUseCases
      Parameters:
      tenantId - (required)
      status - The one lifecycle state to list. Absent: the live use cases (ACTIVE and SUSPENDED). REVOKED lists the use cases that have ended, each with the cause it ended with. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 20)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • listInternalCryptoUseCases

      public PageInternalCryptoUseCaseResponse listInternalCryptoUseCases(@Nonnull UUID tenantId, @Nullable String status, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort) throws ApiException
      List internal crypto use cases for the tenant Paginated list of the tenant's use cases. Without `status` it lists the LIVE use cases — `ACTIVE` and `SUSPENDED`. With `status` it lists exactly that state, and `REVOKED` is selectable: a revoked use case is kept for its history and listed with `revokedAt`, `revokedReason`, `terminalCause` and, when its key was destroyed, `terminalCauseKeyIdentity`. An empty result is 200 with an empty page, never 404. Scope: `admin.tenant.internal-use-case.read`
      Parameters:
      tenantId - (required)
      status - The one lifecycle state to list. Absent: the live use cases (ACTIVE and SUSPENDED). REVOKED lists the use cases that have ended, each with the cause it ended with. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 20)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      Returns:
      PageInternalCryptoUseCaseResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listInternalCryptoUseCasesWithHttpInfo

      public ApiResponse<PageInternalCryptoUseCaseResponse> listInternalCryptoUseCasesWithHttpInfo(@Nonnull UUID tenantId, @Nullable String status, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort) throws ApiException
      List internal crypto use cases for the tenant Paginated list of the tenant's use cases. Without `status` it lists the LIVE use cases — `ACTIVE` and `SUSPENDED`. With `status` it lists exactly that state, and `REVOKED` is selectable: a revoked use case is kept for its history and listed with `revokedAt`, `revokedReason`, `terminalCause` and, when its key was destroyed, `terminalCauseKeyIdentity`. An empty result is 200 with an empty page, never 404. Scope: `admin.tenant.internal-use-case.read`
      Parameters:
      tenantId - (required)
      status - The one lifecycle state to list. Absent: the live use cases (ACTIVE and SUSPENDED). REVOKED lists the use cases that have ended, each with the cause it ended with. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 20)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      Returns:
      ApiResponse<PageInternalCryptoUseCaseResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • listInternalCryptoUseCasesAsync

      public okhttp3.Call listInternalCryptoUseCasesAsync(@Nonnull UUID tenantId, @Nullable String status, @Nullable Integer page, @Nullable Integer size, @Nullable List<String> sort, ApiCallback<PageInternalCryptoUseCaseResponse> _callback) throws ApiException
      List internal crypto use cases for the tenant (asynchronously) Paginated list of the tenant's use cases. Without `status` it lists the LIVE use cases — `ACTIVE` and `SUSPENDED`. With `status` it lists exactly that state, and `REVOKED` is selectable: a revoked use case is kept for its history and listed with `revokedAt`, `revokedReason`, `terminalCause` and, when its key was destroyed, `terminalCauseKeyIdentity`. An empty result is 200 with an empty page, never 404. Scope: `admin.tenant.internal-use-case.read`
      Parameters:
      tenantId - (required)
      status - The one lifecycle state to list. Absent: the live use cases (ACTIVE and SUSPENDED). REVOKED lists the use cases that have ended, each with the cause it ended with. (optional)
      page - Zero-based page index (0..N) (optional, default to 0)
      size - The size of the page to be returned (optional, default to 20)
      sort - Sorting criteria in the format: property,(asc|desc). Default sort order is ascending. Multiple sort criteria are supported. (optional)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • resumeInternalCryptoUseCaseCall

      public okhttp3.Call resumeInternalCryptoUseCaseCall(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, ApiCallback _callback) throws ApiException
      Build call for resumeInternalCryptoUseCase
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • resumeInternalCryptoUseCase

      public InternalCryptoUseCaseResponse resumeInternalCryptoUseCase(@Nonnull UUID tenantId, @Nonnull UUID useCaseId) throws ApiException
      Resume a SUSPENDED use case Transitions the aggregate SUSPENDED → ACTIVE and <b>cascades to the owned Cryptographic Actor</b>, which returns to <code>ACTIVE</code> and has its signed effective-status envelope republished, so crypto operations and new token requests both succeed again. <p>Because suspend revoked nothing, resume recreates nothing: the same Capability Grants, the same never-rotated Actor Credential and the same constraint counters are still in place.</p> <p><b>Resume restores the actor unconditionally.</b> An actor suspended directly on the actor plane — an incident response, say — is cleared by this call too; the platform stores no reason or owner that would distinguish the two suspensions. The actor's pre-transition status is recorded in the audit trail under this request's correlation id.</p> <p>The cascade runs inside this request's transaction: an actor already <code>ACTIVE</code> is a satisfied step (200, no second write); an actor <code>DISABLED</code> is refused 422 under its OWN problem type, <code>.../terminal-actor-state</code>, so a client can tell “retrying is pointless, revoke instead” from “you sent the wrong verb” without string-matching the detail. Idempotent on an already-ACTIVE aggregate → 422, and a concurrent transition → <b>422 as well, never 409</b> — the row is held under <code>PESSIMISTIC_WRITE</code>, so the loser reads COMMITTED state rather than failing an optimistic-lock check. Scope: <code>admin.tenant.internal-use-case.resume</code></p>
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      Returns:
      InternalCryptoUseCaseResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • resumeInternalCryptoUseCaseWithHttpInfo

      public ApiResponse<InternalCryptoUseCaseResponse> resumeInternalCryptoUseCaseWithHttpInfo(@Nonnull UUID tenantId, @Nonnull UUID useCaseId) throws ApiException
      Resume a SUSPENDED use case Transitions the aggregate SUSPENDED → ACTIVE and <b>cascades to the owned Cryptographic Actor</b>, which returns to <code>ACTIVE</code> and has its signed effective-status envelope republished, so crypto operations and new token requests both succeed again. <p>Because suspend revoked nothing, resume recreates nothing: the same Capability Grants, the same never-rotated Actor Credential and the same constraint counters are still in place.</p> <p><b>Resume restores the actor unconditionally.</b> An actor suspended directly on the actor plane — an incident response, say — is cleared by this call too; the platform stores no reason or owner that would distinguish the two suspensions. The actor's pre-transition status is recorded in the audit trail under this request's correlation id.</p> <p>The cascade runs inside this request's transaction: an actor already <code>ACTIVE</code> is a satisfied step (200, no second write); an actor <code>DISABLED</code> is refused 422 under its OWN problem type, <code>.../terminal-actor-state</code>, so a client can tell “retrying is pointless, revoke instead” from “you sent the wrong verb” without string-matching the detail. Idempotent on an already-ACTIVE aggregate → 422, and a concurrent transition → <b>422 as well, never 409</b> — the row is held under <code>PESSIMISTIC_WRITE</code>, so the loser reads COMMITTED state rather than failing an optimistic-lock check. Scope: <code>admin.tenant.internal-use-case.resume</code></p>
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      Returns:
      ApiResponse<InternalCryptoUseCaseResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • resumeInternalCryptoUseCaseAsync

      public okhttp3.Call resumeInternalCryptoUseCaseAsync(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, ApiCallback<InternalCryptoUseCaseResponse> _callback) throws ApiException
      Resume a SUSPENDED use case (asynchronously) Transitions the aggregate SUSPENDED → ACTIVE and <b>cascades to the owned Cryptographic Actor</b>, which returns to <code>ACTIVE</code> and has its signed effective-status envelope republished, so crypto operations and new token requests both succeed again. <p>Because suspend revoked nothing, resume recreates nothing: the same Capability Grants, the same never-rotated Actor Credential and the same constraint counters are still in place.</p> <p><b>Resume restores the actor unconditionally.</b> An actor suspended directly on the actor plane — an incident response, say — is cleared by this call too; the platform stores no reason or owner that would distinguish the two suspensions. The actor's pre-transition status is recorded in the audit trail under this request's correlation id.</p> <p>The cascade runs inside this request's transaction: an actor already <code>ACTIVE</code> is a satisfied step (200, no second write); an actor <code>DISABLED</code> is refused 422 under its OWN problem type, <code>.../terminal-actor-state</code>, so a client can tell “retrying is pointless, revoke instead” from “you sent the wrong verb” without string-matching the detail. Idempotent on an already-ACTIVE aggregate → 422, and a concurrent transition → <b>422 as well, never 409</b> — the row is held under <code>PESSIMISTIC_WRITE</code>, so the loser reads COMMITTED state rather than failing an optimistic-lock check. Scope: <code>admin.tenant.internal-use-case.resume</code></p>
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object

    • suspendInternalCryptoUseCaseCall

      public okhttp3.Call suspendInternalCryptoUseCaseCall(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nonnull SuspendInternalCryptoUseCaseRequest suspendInternalCryptoUseCaseRequest, ApiCallback _callback) throws ApiException
      Build call for suspendInternalCryptoUseCase
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      suspendInternalCryptoUseCaseRequest - (required)
      _callback - Callback for upload/download progress
      Returns:
      Call to execute
      Throws:
      ApiException - If fail to serialize the request body object

    • suspendInternalCryptoUseCase

      public InternalCryptoUseCaseResponse suspendInternalCryptoUseCase(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nonnull SuspendInternalCryptoUseCaseRequest suspendInternalCryptoUseCaseRequest) throws ApiException
      Suspend an ACTIVE use case Transitions the aggregate ACTIVE → SUSPENDED and <b>cascades to the owned Cryptographic Actor</b>, which is what actually stops the workload: the actor moves to <code>SUSPENDED</code> and its signed effective-status envelope is published, so the cryptographic service answers <code>403 actor-suspended</code> on the next crypto call — including one presented with an already-issued, still-valid JWT — and the authentication service answers <code>401 invalid_client</code> for a new token request. <p><b>Nothing is revoked.</b> The Capability Grants, the Actor Credential, the owned Exchange Context and every constraint counter survive the transition untouched, so <code>PATCH /resume</code> restores the same workload rather than provisioning a new one.</p> <p>The cascade runs inside this request's transaction: if the actor transition is refused, the aggregate is not written. An actor already <code>SUSPENDED</code> is a satisfied step (200, no second write); an actor <code>DISABLED</code> is refused 422 under its OWN problem type, <code>.../terminal-actor-state</code>, so a client can tell “retrying is pointless, revoke instead” from “you sent the wrong verb” without string-matching the detail. The exit is still named in the detail for a human reader.</p> <p>Idempotent on an already-SUSPENDED aggregate → 422. A concurrent transition answers <b>422 as well, never 409</b>: the aggregate row is taken under <code>PESSIMISTIC_WRITE</code>, so the second caller blocks and then reads COMMITTED state — an already-SUSPENDED aggregate — and is refused as an invalid transition. The 409 optimistic-lock arm exists on this service but is unreachable from this path.</p> <p><b>A body is REQUIRED, and it carries a mandatory justification.</b> <code>reason</code> is recorded verbatim at canonical position 21 of the signed admin audit event, so no audit row records a stop without its reason. It is bounded at the audit reason limit (1,000 UTF-8 BYTES, not characters) — the same bound applied before signing, so no accepted value is silently truncated on its way into the preimage — and it is NEVER written to a log line.</p> <p>Accepting a body introduces two arms this operation did not have: <b>400</b> for a blank, absent or over-long reason, and <b>415</b> for a request whose <code>Content-Type</code> is not <code>application/json</code>. Every refusal on this path — 404, the two state refusals, the DISABLED-actor refusal and both new ones — records the submitted justification NOWHERE, because the act did not happen. Scope: <code>admin.tenant.internal-use-case.suspend</code></p>
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      suspendInternalCryptoUseCaseRequest - (required)
      Returns:
      InternalCryptoUseCaseResponse
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • suspendInternalCryptoUseCaseWithHttpInfo

      public ApiResponse<InternalCryptoUseCaseResponse> suspendInternalCryptoUseCaseWithHttpInfo(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nonnull SuspendInternalCryptoUseCaseRequest suspendInternalCryptoUseCaseRequest) throws ApiException
      Suspend an ACTIVE use case Transitions the aggregate ACTIVE → SUSPENDED and <b>cascades to the owned Cryptographic Actor</b>, which is what actually stops the workload: the actor moves to <code>SUSPENDED</code> and its signed effective-status envelope is published, so the cryptographic service answers <code>403 actor-suspended</code> on the next crypto call — including one presented with an already-issued, still-valid JWT — and the authentication service answers <code>401 invalid_client</code> for a new token request. <p><b>Nothing is revoked.</b> The Capability Grants, the Actor Credential, the owned Exchange Context and every constraint counter survive the transition untouched, so <code>PATCH /resume</code> restores the same workload rather than provisioning a new one.</p> <p>The cascade runs inside this request's transaction: if the actor transition is refused, the aggregate is not written. An actor already <code>SUSPENDED</code> is a satisfied step (200, no second write); an actor <code>DISABLED</code> is refused 422 under its OWN problem type, <code>.../terminal-actor-state</code>, so a client can tell “retrying is pointless, revoke instead” from “you sent the wrong verb” without string-matching the detail. The exit is still named in the detail for a human reader.</p> <p>Idempotent on an already-SUSPENDED aggregate → 422. A concurrent transition answers <b>422 as well, never 409</b>: the aggregate row is taken under <code>PESSIMISTIC_WRITE</code>, so the second caller blocks and then reads COMMITTED state — an already-SUSPENDED aggregate — and is refused as an invalid transition. The 409 optimistic-lock arm exists on this service but is unreachable from this path.</p> <p><b>A body is REQUIRED, and it carries a mandatory justification.</b> <code>reason</code> is recorded verbatim at canonical position 21 of the signed admin audit event, so no audit row records a stop without its reason. It is bounded at the audit reason limit (1,000 UTF-8 BYTES, not characters) — the same bound applied before signing, so no accepted value is silently truncated on its way into the preimage — and it is NEVER written to a log line.</p> <p>Accepting a body introduces two arms this operation did not have: <b>400</b> for a blank, absent or over-long reason, and <b>415</b> for a request whose <code>Content-Type</code> is not <code>application/json</code>. Every refusal on this path — 404, the two state refusals, the DISABLED-actor refusal and both new ones — records the submitted justification NOWHERE, because the act did not happen. Scope: <code>admin.tenant.internal-use-case.suspend</code></p>
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      suspendInternalCryptoUseCaseRequest - (required)
      Returns:
      ApiResponse<InternalCryptoUseCaseResponse>
      Throws:
      ApiException - If fail to call the API, e.g. server error or cannot deserialize the response body

    • suspendInternalCryptoUseCaseAsync

      public okhttp3.Call suspendInternalCryptoUseCaseAsync(@Nonnull UUID tenantId, @Nonnull UUID useCaseId, @Nonnull SuspendInternalCryptoUseCaseRequest suspendInternalCryptoUseCaseRequest, ApiCallback<InternalCryptoUseCaseResponse> _callback) throws ApiException
      Suspend an ACTIVE use case (asynchronously) Transitions the aggregate ACTIVE → SUSPENDED and <b>cascades to the owned Cryptographic Actor</b>, which is what actually stops the workload: the actor moves to <code>SUSPENDED</code> and its signed effective-status envelope is published, so the cryptographic service answers <code>403 actor-suspended</code> on the next crypto call — including one presented with an already-issued, still-valid JWT — and the authentication service answers <code>401 invalid_client</code> for a new token request. <p><b>Nothing is revoked.</b> The Capability Grants, the Actor Credential, the owned Exchange Context and every constraint counter survive the transition untouched, so <code>PATCH /resume</code> restores the same workload rather than provisioning a new one.</p> <p>The cascade runs inside this request's transaction: if the actor transition is refused, the aggregate is not written. An actor already <code>SUSPENDED</code> is a satisfied step (200, no second write); an actor <code>DISABLED</code> is refused 422 under its OWN problem type, <code>.../terminal-actor-state</code>, so a client can tell “retrying is pointless, revoke instead” from “you sent the wrong verb” without string-matching the detail. The exit is still named in the detail for a human reader.</p> <p>Idempotent on an already-SUSPENDED aggregate → 422. A concurrent transition answers <b>422 as well, never 409</b>: the aggregate row is taken under <code>PESSIMISTIC_WRITE</code>, so the second caller blocks and then reads COMMITTED state — an already-SUSPENDED aggregate — and is refused as an invalid transition. The 409 optimistic-lock arm exists on this service but is unreachable from this path.</p> <p><b>A body is REQUIRED, and it carries a mandatory justification.</b> <code>reason</code> is recorded verbatim at canonical position 21 of the signed admin audit event, so no audit row records a stop without its reason. It is bounded at the audit reason limit (1,000 UTF-8 BYTES, not characters) — the same bound applied before signing, so no accepted value is silently truncated on its way into the preimage — and it is NEVER written to a log line.</p> <p>Accepting a body introduces two arms this operation did not have: <b>400</b> for a blank, absent or over-long reason, and <b>415</b> for a request whose <code>Content-Type</code> is not <code>application/json</code>. Every refusal on this path — 404, the two state refusals, the DISABLED-actor refusal and both new ones — records the submitted justification NOWHERE, because the act did not happen. Scope: <code>admin.tenant.internal-use-case.suspend</code></p>
      Parameters:
      tenantId - (required)
      useCaseId - (required)
      suspendInternalCryptoUseCaseRequest - (required)
      _callback - The callback to be executed when the API call finishes
      Returns:
      The request call
      Throws:
      ApiException - If fail to process the API call, e.g. serializing the request body object