--- title: Getting Started with Datadog description: Datadog, the leading service for cloud-scale monitoring. breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog --- # aws_pca_connector_ad_directory_registration{% #aws_pca_connector_ad_directory_registration %} ## `account_id`{% #account_id %} **Type**: `STRING` ## `arn`{% #arn %} **Type**: `STRING`**Provider name**: `Arn`**Description**: The Amazon Resource Name (ARN) that was returned when you called [CreateTemplate](https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateTemplate.html). ## `connector_arn`{% #connector_arn %} **Type**: `STRING`**Provider name**: `ConnectorArn`**Description**: The Amazon Resource Name (ARN) that was returned when you called [CreateConnector](https://docs.aws.amazon.com/pca-connector-ad/latest/APIReference/API_CreateConnector.html). ## `created_at`{% #created_at %} **Type**: `TIMESTAMP`**Provider name**: `CreatedAt`**Description**: The date and time that the template was created. ## `definition`{% #definition %} **Type**: `STRUCT`**Provider name**: `Definition`**Description**: Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. - `template_v2`**Type**: `STRUCT`**Provider name**: `TemplateV2`**Description**: Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. - `certificate_validity`**Type**: `STRUCT`**Provider name**: `CertificateValidity`**Description**: Certificate validity describes the validity and renewal periods of a certificate. - `renewal_period`**Type**: `STRUCT`**Provider name**: `RenewalPeriod`**Description**: Renewal period is the period of time before certificate expiration when a new certificate will be requested. - `period`**Type**: `INT64`**Provider name**: `Period`**Description**: The numeric value for the validity period. - `period_type`**Type**: `STRING`**Provider name**: `PeriodType`**Description**: The unit of time. You can select hours, days, weeks, months, and years. - `validity_period`**Type**: `STRUCT`**Provider name**: `ValidityPeriod`**Description**: Information describing the end of the validity period of the certificate. This parameter sets the "Not After" date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. - `period`**Type**: `INT64`**Provider name**: `Period`**Description**: The numeric value for the validity period. - `period_type`**Type**: `STRING`**Provider name**: `PeriodType`**Description**: The unit of time. You can select hours, days, weeks, months, and years. - `enrollment_flags`**Type**: `STRUCT`**Provider name**: `EnrollmentFlags`**Description**: Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. - `enable_key_reuse_on_nt_token_keyset_storage_full`**Type**: `BOOLEAN`**Provider name**: `EnableKeyReuseOnNtTokenKeysetStorageFull`**Description**: Allow renewal using the same key. - `include_symmetric_algorithms`**Type**: `BOOLEAN`**Provider name**: `IncludeSymmetricAlgorithms`**Description**: Include symmetric algorithms allowed by the subject. - `no_security_extension`**Type**: `BOOLEAN`**Provider name**: `NoSecurityExtension`**Description**: This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. - `remove_invalid_certificate_from_personal_store`**Type**: `BOOLEAN`**Provider name**: `RemoveInvalidCertificateFromPersonalStore`**Description**: Delete expired or revoked certificates instead of archiving them. - `user_interaction_required`**Type**: `BOOLEAN`**Provider name**: `UserInteractionRequired`**Description**: Require user interaction when the subject is enrolled and the private key associated with the certificate is used. - `extensions`**Type**: `STRUCT`**Provider name**: `Extensions`**Description**: Extensions describe the key usage extensions and application policies for a template. - `application_policies`**Type**: `STRUCT`**Provider name**: `ApplicationPolicies`**Description**: Application policies specify what the certificate is used for and its purpose. - `critical`**Type**: `BOOLEAN`**Provider name**: `Critical`**Description**: Marks the application policy extension as critical. - `policies`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Policies`**Description**: Application policies describe what the certificate can be used for. - `policy_object_identifier`**Type**: `STRING`**Provider name**: `PolicyObjectIdentifier`**Description**: The object identifier (OID) of an application policy. - `policy_type`**Type**: `STRING`**Provider name**: `PolicyType`**Description**: The type of application policy - `key_usage`**Type**: `STRUCT`**Provider name**: `KeyUsage`**Description**: The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. - `critical`**Type**: `BOOLEAN`**Provider name**: `Critical`**Description**: Sets the key usage extension to critical. - `usage_flags`**Type**: `STRUCT`**Provider name**: `UsageFlags`**Description**: The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. - `data_encipherment`**Type**: `BOOLEAN`**Provider name**: `DataEncipherment`**Description**: DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. - `digital_signature`**Type**: `BOOLEAN`**Provider name**: `DigitalSignature`**Description**: The digitalSignature is asserted when the subject public key is used for verifying digital signatures. - `key_agreement`**Type**: `BOOLEAN`**Provider name**: `KeyAgreement`**Description**: KeyAgreement is asserted when the subject public key is used for key agreement. - `key_encipherment`**Type**: `BOOLEAN`**Provider name**: `KeyEncipherment`**Description**: KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. - `non_repudiation`**Type**: `BOOLEAN`**Provider name**: `NonRepudiation`**Description**: NonRepudiation is asserted when the subject public key is used to verify digital signatures. - `general_flags`**Type**: `STRUCT`**Provider name**: `GeneralFlags`**Description**: General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. - `auto_enrollment`**Type**: `BOOLEAN`**Provider name**: `AutoEnrollment`**Description**: Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. - `machine_type`**Type**: `BOOLEAN`**Provider name**: `MachineType`**Description**: Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users. - `private_key_attributes`**Type**: `STRUCT`**Provider name**: `PrivateKeyAttributes`**Description**: Private key attributes allow you to specify the minimal key length, key spec, and cryptographic providers for the private key of a certificate for v2 templates. V2 templates allow you to use Legacy Cryptographic Service Providers. - `crypto_providers`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `CryptoProviders`**Description**: Defines the cryptographic providers used to generate the private key. - `key_spec`**Type**: `STRING`**Provider name**: `KeySpec`**Description**: Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. - `minimal_key_length`**Type**: `INT32`**Provider name**: `MinimalKeyLength`**Description**: Set the minimum key length of the private key. - `private_key_flags`**Type**: `STRUCT`**Provider name**: `PrivateKeyFlags`**Description**: Private key flags for v2 templates specify the client compatibility, if the private key can be exported, and if user input is required when using a private key. - `client_version`**Type**: `STRING`**Provider name**: `ClientVersion`**Description**: Defines the minimum client compatibility. - `exportable_key`**Type**: `BOOLEAN`**Provider name**: `ExportableKey`**Description**: Allows the private key to be exported. - `strong_key_protection_required`**Type**: `BOOLEAN`**Provider name**: `StrongKeyProtectionRequired`**Description**: Require user input when using the private key for enrollment. - `subject_name_flags`**Type**: `STRUCT`**Provider name**: `SubjectNameFlags`**Description**: Subject name flags describe the subject name and subject alternate name that is included in a certificate. - `require_common_name`**Type**: `BOOLEAN`**Provider name**: `RequireCommonName`**Description**: Include the common name in the subject name. - `require_directory_path`**Type**: `BOOLEAN`**Provider name**: `RequireDirectoryPath`**Description**: Include the directory path in the subject name. - `require_dns_as_cn`**Type**: `BOOLEAN`**Provider name**: `RequireDnsAsCn`**Description**: Include the DNS as common name in the subject name. - `require_email`**Type**: `BOOLEAN`**Provider name**: `RequireEmail`**Description**: Include the subject's email in the subject name. - `san_require_directory_guid`**Type**: `BOOLEAN`**Provider name**: `SanRequireDirectoryGuid`**Description**: Include the globally unique identifier (GUID) in the subject alternate name. - `san_require_dns`**Type**: `BOOLEAN`**Provider name**: `SanRequireDns`**Description**: Include the DNS in the subject alternate name. - `san_require_domain_dns`**Type**: `BOOLEAN`**Provider name**: `SanRequireDomainDns`**Description**: Include the domain DNS in the subject alternate name. - `san_require_email`**Type**: `BOOLEAN`**Provider name**: `SanRequireEmail`**Description**: Include the subject's email in the subject alternate name. - `san_require_spn`**Type**: `BOOLEAN`**Provider name**: `SanRequireSpn`**Description**: Include the service principal name (SPN) in the subject alternate name. - `san_require_upn`**Type**: `BOOLEAN`**Provider name**: `SanRequireUpn`**Description**: Include the user principal name (UPN) in the subject alternate name. - `superseded_templates`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `SupersededTemplates`**Description**: List of templates in Active Directory that are superseded by this template. - `template_v3`**Type**: `STRUCT`**Provider name**: `TemplateV3`**Description**: Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. - `certificate_validity`**Type**: `STRUCT`**Provider name**: `CertificateValidity`**Description**: Certificate validity describes the validity and renewal periods of a certificate. - `renewal_period`**Type**: `STRUCT`**Provider name**: `RenewalPeriod`**Description**: Renewal period is the period of time before certificate expiration when a new certificate will be requested. - `period`**Type**: `INT64`**Provider name**: `Period`**Description**: The numeric value for the validity period. - `period_type`**Type**: `STRING`**Provider name**: `PeriodType`**Description**: The unit of time. You can select hours, days, weeks, months, and years. - `validity_period`**Type**: `STRUCT`**Provider name**: `ValidityPeriod`**Description**: Information describing the end of the validity period of the certificate. This parameter sets the "Not After" date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. - `period`**Type**: `INT64`**Provider name**: `Period`**Description**: The numeric value for the validity period. - `period_type`**Type**: `STRING`**Provider name**: `PeriodType`**Description**: The unit of time. You can select hours, days, weeks, months, and years. - `enrollment_flags`**Type**: `STRUCT`**Provider name**: `EnrollmentFlags`**Description**: Enrollment flags describe the enrollment settings for certificates such as using the existing private key and deleting expired or revoked certificates. - `enable_key_reuse_on_nt_token_keyset_storage_full`**Type**: `BOOLEAN`**Provider name**: `EnableKeyReuseOnNtTokenKeysetStorageFull`**Description**: Allow renewal using the same key. - `include_symmetric_algorithms`**Type**: `BOOLEAN`**Provider name**: `IncludeSymmetricAlgorithms`**Description**: Include symmetric algorithms allowed by the subject. - `no_security_extension`**Type**: `BOOLEAN`**Provider name**: `NoSecurityExtension`**Description**: This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. - `remove_invalid_certificate_from_personal_store`**Type**: `BOOLEAN`**Provider name**: `RemoveInvalidCertificateFromPersonalStore`**Description**: Delete expired or revoked certificates instead of archiving them. - `user_interaction_required`**Type**: `BOOLEAN`**Provider name**: `UserInteractionRequired`**Description**: Require user interaction when the subject is enrolled and the private key associated with the certificate is used. - `extensions`**Type**: `STRUCT`**Provider name**: `Extensions`**Description**: Extensions describe the key usage extensions and application policies for a template. - `application_policies`**Type**: `STRUCT`**Provider name**: `ApplicationPolicies`**Description**: Application policies specify what the certificate is used for and its purpose. - `critical`**Type**: `BOOLEAN`**Provider name**: `Critical`**Description**: Marks the application policy extension as critical. - `policies`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Policies`**Description**: Application policies describe what the certificate can be used for. - `policy_object_identifier`**Type**: `STRING`**Provider name**: `PolicyObjectIdentifier`**Description**: The object identifier (OID) of an application policy. - `policy_type`**Type**: `STRING`**Provider name**: `PolicyType`**Description**: The type of application policy - `key_usage`**Type**: `STRUCT`**Provider name**: `KeyUsage`**Description**: The key usage extension defines the purpose (e.g., encipherment, signature, certificate signing) of the key contained in the certificate. - `critical`**Type**: `BOOLEAN`**Provider name**: `Critical`**Description**: Sets the key usage extension to critical. - `usage_flags`**Type**: `STRUCT`**Provider name**: `UsageFlags`**Description**: The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. - `data_encipherment`**Type**: `BOOLEAN`**Provider name**: `DataEncipherment`**Description**: DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. - `digital_signature`**Type**: `BOOLEAN`**Provider name**: `DigitalSignature`**Description**: The digitalSignature is asserted when the subject public key is used for verifying digital signatures. - `key_agreement`**Type**: `BOOLEAN`**Provider name**: `KeyAgreement`**Description**: KeyAgreement is asserted when the subject public key is used for key agreement. - `key_encipherment`**Type**: `BOOLEAN`**Provider name**: `KeyEncipherment`**Description**: KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. - `non_repudiation`**Type**: `BOOLEAN`**Provider name**: `NonRepudiation`**Description**: NonRepudiation is asserted when the subject public key is used to verify digital signatures. - `general_flags`**Type**: `STRUCT`**Provider name**: `GeneralFlags`**Description**: General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. - `auto_enrollment`**Type**: `BOOLEAN`**Provider name**: `AutoEnrollment`**Description**: Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. - `machine_type`**Type**: `BOOLEAN`**Provider name**: `MachineType`**Description**: Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users - `hash_algorithm`**Type**: `STRING`**Provider name**: `HashAlgorithm`**Description**: Specifies the hash algorithm used to hash the private key. - `private_key_attributes`**Type**: `STRUCT`**Provider name**: `PrivateKeyAttributes`**Description**: Private key attributes allow you to specify the algorithm, minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v3 templates. V3 templates allow you to use Key Storage Providers. - `algorithm`**Type**: `STRING`**Provider name**: `Algorithm`**Description**: Defines the algorithm used to generate the private key. - `crypto_providers`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `CryptoProviders`**Description**: Defines the cryptographic providers used to generate the private key. - `key_spec`**Type**: `STRING`**Provider name**: `KeySpec`**Description**: Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. - `key_usage_property`**Type**: `STRUCT`**Provider name**: `KeyUsageProperty`**Description**: The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. - `property_flags`**Type**: `STRUCT`**Provider name**: `PropertyFlags`**Description**: You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. - `decrypt`**Type**: `BOOLEAN`**Provider name**: `Decrypt`**Description**: Allows key for encryption and decryption. - `key_agreement`**Type**: `BOOLEAN`**Provider name**: `KeyAgreement`**Description**: Allows key exchange without encryption. - `sign`**Type**: `BOOLEAN`**Provider name**: `Sign`**Description**: Allow key use for digital signature. - `property_type`**Type**: `STRING`**Provider name**: `PropertyType`**Description**: You can specify all key usages using property type ALL. You can use property type or property flags but not both. - `minimal_key_length`**Type**: `INT32`**Provider name**: `MinimalKeyLength`**Description**: Set the minimum key length of the private key. - `private_key_flags`**Type**: `STRUCT`**Provider name**: `PrivateKeyFlags`**Description**: Private key flags for v3 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, and if an alternate signature algorithm should be used. - `client_version`**Type**: `STRING`**Provider name**: `ClientVersion`**Description**: Defines the minimum client compatibility. - `exportable_key`**Type**: `BOOLEAN`**Provider name**: `ExportableKey`**Description**: Allows the private key to be exported. - `require_alternate_signature_algorithm`**Type**: `BOOLEAN`**Provider name**: `RequireAlternateSignatureAlgorithm`**Description**: Reguires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. - `strong_key_protection_required`**Type**: `BOOLEAN`**Provider name**: `StrongKeyProtectionRequired`**Description**: Requirer user input when using the private key for enrollment. - `subject_name_flags`**Type**: `STRUCT`**Provider name**: `SubjectNameFlags`**Description**: Subject name flags describe the subject name and subject alternate name that is included in a certificate. - `require_common_name`**Type**: `BOOLEAN`**Provider name**: `RequireCommonName`**Description**: Include the common name in the subject name. - `require_directory_path`**Type**: `BOOLEAN`**Provider name**: `RequireDirectoryPath`**Description**: Include the directory path in the subject name. - `require_dns_as_cn`**Type**: `BOOLEAN`**Provider name**: `RequireDnsAsCn`**Description**: Include the DNS as common name in the subject name. - `require_email`**Type**: `BOOLEAN`**Provider name**: `RequireEmail`**Description**: Include the subject's email in the subject name. - `san_require_directory_guid`**Type**: `BOOLEAN`**Provider name**: `SanRequireDirectoryGuid`**Description**: Include the globally unique identifier (GUID) in the subject alternate name. - `san_require_dns`**Type**: `BOOLEAN`**Provider name**: `SanRequireDns`**Description**: Include the DNS in the subject alternate name. - `san_require_domain_dns`**Type**: `BOOLEAN`**Provider name**: `SanRequireDomainDns`**Description**: Include the domain DNS in the subject alternate name. - `san_require_email`**Type**: `BOOLEAN`**Provider name**: `SanRequireEmail`**Description**: Include the subject's email in the subject alternate name. - `san_require_spn`**Type**: `BOOLEAN`**Provider name**: `SanRequireSpn`**Description**: Include the service principal name (SPN) in the subject alternate name. - `san_require_upn`**Type**: `BOOLEAN`**Provider name**: `SanRequireUpn`**Description**: Include the user principal name (UPN) in the subject alternate name. - `superseded_templates`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `SupersededTemplates`**Description**: List of templates in Active Directory that are superseded by this template. - `template_v4`**Type**: `STRUCT`**Provider name**: `TemplateV4`**Description**: Template configuration to define the information included in certificates. Define certificate validity and renewal periods, certificate request handling and enrollment options, key usage extensions, application policies, and cryptography settings. - `certificate_validity`**Type**: `STRUCT`**Provider name**: `CertificateValidity`**Description**: Certificate validity describes the validity and renewal periods of a certificate. - `renewal_period`**Type**: `STRUCT`**Provider name**: `RenewalPeriod`**Description**: Renewal period is the period of time before certificate expiration when a new certificate will be requested. - `period`**Type**: `INT64`**Provider name**: `Period`**Description**: The numeric value for the validity period. - `period_type`**Type**: `STRING`**Provider name**: `PeriodType`**Description**: The unit of time. You can select hours, days, weeks, months, and years. - `validity_period`**Type**: `STRUCT`**Provider name**: `ValidityPeriod`**Description**: Information describing the end of the validity period of the certificate. This parameter sets the "Not After" date for the certificate. Certificate validity is the period of time during which a certificate is valid. Validity can be expressed as an explicit date and time when the certificate expires, or as a span of time after issuance, stated in days, months, or years. For more information, see Validity in RFC 5280. This value is unaffected when ValidityNotBefore is also specified. For example, if Validity is set to 20 days in the future, the certificate will expire 20 days from issuance time regardless of the ValidityNotBefore value. - `period`**Type**: `INT64`**Provider name**: `Period`**Description**: The numeric value for the validity period. - `period_type`**Type**: `STRING`**Provider name**: `PeriodType`**Description**: The unit of time. You can select hours, days, weeks, months, and years. - `enrollment_flags`**Type**: `STRUCT`**Provider name**: `EnrollmentFlags`**Description**: Enrollment flags describe the enrollment settings for certificates using the existing private key and deleting expired or revoked certificates. - `enable_key_reuse_on_nt_token_keyset_storage_full`**Type**: `BOOLEAN`**Provider name**: `EnableKeyReuseOnNtTokenKeysetStorageFull`**Description**: Allow renewal using the same key. - `include_symmetric_algorithms`**Type**: `BOOLEAN`**Provider name**: `IncludeSymmetricAlgorithms`**Description**: Include symmetric algorithms allowed by the subject. - `no_security_extension`**Type**: `BOOLEAN`**Provider name**: `NoSecurityExtension`**Description**: This flag instructs the CA to not include the security extension szOID_NTDS_CA_SECURITY_EXT (OID:1.3.6.1.4.1.311.25.2), as specified in [MS-WCCE] sections 2.2.2.7.7.4 and 3.2.2.6.2.1.4.5.9, in the issued certificate. This addresses a Windows Kerberos elevation-of-privilege vulnerability. - `remove_invalid_certificate_from_personal_store`**Type**: `BOOLEAN`**Provider name**: `RemoveInvalidCertificateFromPersonalStore`**Description**: Delete expired or revoked certificates instead of archiving them. - `user_interaction_required`**Type**: `BOOLEAN`**Provider name**: `UserInteractionRequired`**Description**: Require user interaction when the subject is enrolled and the private key associated with the certificate is used. - `extensions`**Type**: `STRUCT`**Provider name**: `Extensions`**Description**: Extensions describe the key usage extensions and application policies for a template. - `application_policies`**Type**: `STRUCT`**Provider name**: `ApplicationPolicies`**Description**: Application policies specify what the certificate is used for and its purpose. - `critical`**Type**: `BOOLEAN`**Provider name**: `Critical`**Description**: Marks the application policy extension as critical. - `policies`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Policies`**Description**: Application policies describe what the certificate can be used for. - `policy_object_identifier`**Type**: `STRING`**Provider name**: `PolicyObjectIdentifier`**Description**: The object identifier (OID) of an application policy. - `policy_type`**Type**: `STRING`**Provider name**: `PolicyType`**Description**: The type of application policy - `key_usage`**Type**: `STRUCT`**Provider name**: `KeyUsage`**Description**: The key usage extension defines the purpose (e.g., encipherment, signature) of the key contained in the certificate. - `critical`**Type**: `BOOLEAN`**Provider name**: `Critical`**Description**: Sets the key usage extension to critical. - `usage_flags`**Type**: `STRUCT`**Provider name**: `UsageFlags`**Description**: The key usage flags represent the purpose (e.g., encipherment, signature) of the key contained in the certificate. - `data_encipherment`**Type**: `BOOLEAN`**Provider name**: `DataEncipherment`**Description**: DataEncipherment is asserted when the subject public key is used for directly enciphering raw user data without the use of an intermediate symmetric cipher. - `digital_signature`**Type**: `BOOLEAN`**Provider name**: `DigitalSignature`**Description**: The digitalSignature is asserted when the subject public key is used for verifying digital signatures. - `key_agreement`**Type**: `BOOLEAN`**Provider name**: `KeyAgreement`**Description**: KeyAgreement is asserted when the subject public key is used for key agreement. - `key_encipherment`**Type**: `BOOLEAN`**Provider name**: `KeyEncipherment`**Description**: KeyEncipherment is asserted when the subject public key is used for enciphering private or secret keys, i.e., for key transport. - `non_repudiation`**Type**: `BOOLEAN`**Provider name**: `NonRepudiation`**Description**: NonRepudiation is asserted when the subject public key is used to verify digital signatures. - `general_flags`**Type**: `STRUCT`**Provider name**: `GeneralFlags`**Description**: General flags describe whether the template is used for computers or users and if the template can be used with autoenrollment. - `auto_enrollment`**Type**: `BOOLEAN`**Provider name**: `AutoEnrollment`**Description**: Allows certificate issuance using autoenrollment. Set to TRUE to allow autoenrollment. - `machine_type`**Type**: `BOOLEAN`**Provider name**: `MachineType`**Description**: Defines if the template is for machines or users. Set to TRUE if the template is for machines. Set to FALSE if the template is for users - `hash_algorithm`**Type**: `STRING`**Provider name**: `HashAlgorithm`**Description**: Specifies the hash algorithm used to hash the private key. Hash algorithm can only be specified when using Key Storage Providers. - `private_key_attributes`**Type**: `STRUCT`**Provider name**: `PrivateKeyAttributes`**Description**: Private key attributes allow you to specify the minimal key length, key spec, key usage, and cryptographic providers for the private key of a certificate for v4 templates. V4 templates allow you to use either Key Storage Providers or Legacy Cryptographic Service Providers. You specify the cryptography provider category in private key flags. - `algorithm`**Type**: `STRING`**Provider name**: `Algorithm`**Description**: Defines the algorithm used to generate the private key. - `crypto_providers`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `CryptoProviders`**Description**: Defines the cryptographic providers used to generate the private key. - `key_spec`**Type**: `STRING`**Provider name**: `KeySpec`**Description**: Defines the purpose of the private key. Set it to "KEY_EXCHANGE" or "SIGNATURE" value. - `key_usage_property`**Type**: `STRUCT`**Provider name**: `KeyUsageProperty`**Description**: The key usage property defines the purpose of the private key contained in the certificate. You can specify specific purposes using property flags or all by using property type ALL. - `property_flags`**Type**: `STRUCT`**Provider name**: `PropertyFlags`**Description**: You can specify key usage for encryption, key agreement, and signature. You can use property flags or property type but not both. - `decrypt`**Type**: `BOOLEAN`**Provider name**: `Decrypt`**Description**: Allows key for encryption and decryption. - `key_agreement`**Type**: `BOOLEAN`**Provider name**: `KeyAgreement`**Description**: Allows key exchange without encryption. - `sign`**Type**: `BOOLEAN`**Provider name**: `Sign`**Description**: Allow key use for digital signature. - `property_type`**Type**: `STRING`**Provider name**: `PropertyType`**Description**: You can specify all key usages using property type ALL. You can use property type or property flags but not both. - `minimal_key_length`**Type**: `INT32`**Provider name**: `MinimalKeyLength`**Description**: Set the minimum key length of the private key. - `private_key_flags`**Type**: `STRUCT`**Provider name**: `PrivateKeyFlags`**Description**: Private key flags for v4 templates specify the client compatibility, if the private key can be exported, if user input is required when using a private key, if an alternate signature algorithm should be used, and if certificates are renewed using the same private key. - `client_version`**Type**: `STRING`**Provider name**: `ClientVersion`**Description**: Defines the minimum client compatibility. - `exportable_key`**Type**: `BOOLEAN`**Provider name**: `ExportableKey`**Description**: Allows the private key to be exported. - `require_alternate_signature_algorithm`**Type**: `BOOLEAN`**Provider name**: `RequireAlternateSignatureAlgorithm`**Description**: Requires the PKCS #1 v2.1 signature format for certificates. You should verify that your CA, objects, and applications can accept this signature format. - `require_same_key_renewal`**Type**: `BOOLEAN`**Provider name**: `RequireSameKeyRenewal`**Description**: Renew certificate using the same private key. - `strong_key_protection_required`**Type**: `BOOLEAN`**Provider name**: `StrongKeyProtectionRequired`**Description**: Require user input when using the private key for enrollment. - `use_legacy_provider`**Type**: `BOOLEAN`**Provider name**: `UseLegacyProvider`**Description**: Specifies the cryptographic service provider category used to generate private keys. Set to TRUE to use Legacy Cryptographic Service Providers and FALSE to use Key Storage Providers. - `subject_name_flags`**Type**: `STRUCT`**Provider name**: `SubjectNameFlags`**Description**: Subject name flags describe the subject name and subject alternate name that is included in a certificate. - `require_common_name`**Type**: `BOOLEAN`**Provider name**: `RequireCommonName`**Description**: Include the common name in the subject name. - `require_directory_path`**Type**: `BOOLEAN`**Provider name**: `RequireDirectoryPath`**Description**: Include the directory path in the subject name. - `require_dns_as_cn`**Type**: `BOOLEAN`**Provider name**: `RequireDnsAsCn`**Description**: Include the DNS as common name in the subject name. - `require_email`**Type**: `BOOLEAN`**Provider name**: `RequireEmail`**Description**: Include the subject's email in the subject name. - `san_require_directory_guid`**Type**: `BOOLEAN`**Provider name**: `SanRequireDirectoryGuid`**Description**: Include the globally unique identifier (GUID) in the subject alternate name. - `san_require_dns`**Type**: `BOOLEAN`**Provider name**: `SanRequireDns`**Description**: Include the DNS in the subject alternate name. - `san_require_domain_dns`**Type**: `BOOLEAN`**Provider name**: `SanRequireDomainDns`**Description**: Include the domain DNS in the subject alternate name. - `san_require_email`**Type**: `BOOLEAN`**Provider name**: `SanRequireEmail`**Description**: Include the subject's email in the subject alternate name. - `san_require_spn`**Type**: `BOOLEAN`**Provider name**: `SanRequireSpn`**Description**: Include the service principal name (SPN) in the subject alternate name. - `san_require_upn`**Type**: `BOOLEAN`**Provider name**: `SanRequireUpn`**Description**: Include the user principal name (UPN) in the subject alternate name. - `superseded_templates`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `SupersededTemplates`**Description**: List of templates in Active Directory that are superseded by this template. ## `directory_id`{% #directory_id %} **Type**: `STRING`**Provider name**: `DirectoryId`**Description**: The identifier of the Active Directory. ## `name`{% #name %} **Type**: `STRING`**Provider name**: `Name`**Description**: Name of the template. The template name must be unique. ## `object_identifier`{% #object_identifier %} **Type**: `STRING`**Provider name**: `ObjectIdentifier`**Description**: Object identifier of a template. ## `policy_schema`{% #policy_schema %} **Type**: `INT32`**Provider name**: `PolicySchema`**Description**: The template schema version. Template schema versions can be v2, v3, or v4. The template configuration options change based on the template schema version. ## `revision`{% #revision %} **Type**: `STRUCT`**Provider name**: `Revision`**Description**: The revision version of the template. Template updates will increment the minor revision. Re-enrolling all certificate holders will increment the major revision. - `major_revision`**Type**: `INT32`**Provider name**: `MajorRevision`**Description**: The revision version of the template. Re-enrolling all certificate holders will increment the major revision. - `minor_revision`**Type**: `INT32`**Provider name**: `MinorRevision`**Description**: The revision version of the template. Re-enrolling all certificate holders will increment the major revision. ## `status`{% #status %} **Type**: `STRING`**Provider name**: `Status`**Description**: Status of the template. Status can be creating, active, deleting, or failed. ## `status_reason`{% #status_reason %} **Type**: `STRING`**Provider name**: `StatusReason`**Description**: Additional information about the directory registration status if the status is failed. ## `tags`{% #tags %} **Type**: `UNORDERED_LIST_STRING` ## `updated_at`{% #updated_at %} **Type**: `TIMESTAMP`**Provider name**: `UpdatedAt`**Description**: The date and time that the template was updated.