Mutations overview | Machine Identity Management

📄️ abortCloudDiscovery

Aborts an in-progress cloud discovery scan.

📄️ approveCertificateRevocationInBulk

Approves or rejects pending certificate revocation requests in bulk. Returns an operation ID to track the status of each individual approval.

📄️ approveCertificateRevocation

Approves or rejects a pending certificate revocation request.

📄️ bulkCreateExternalEmailRecipient

Creates multiple external email recipients at once.

📄️ createACMEServer

Creates a new ACME Server. The response contains the server's Directory URL and EAB Credentials needed for ACME client configuration.

📄️ createCloudKeystore

Creates a new cloud keystore within a cloud provider.

📄️ createCloudProvider

Creates a new cloud provider connection (AWS, Azure, or GCP).

📄️ createCluster

Creates one or more new clusters for cert-manager management.

📄️ createCompliancePolicy

Creates one or more compliance policies.

📄️ createExternalEmailRecipient

Creates a new external email recipient for notifications.

📄️ createNotificationRouter

Creates a new notification router that routes events to integrations based on filter criteria.

📄️ createNotificationRoutingConfiguration

Creates a notification routing configuration with filter and integration settings.

📄️ createPagerDutyIntegration

Creates a PagerDuty integration for sending incident notifications.

📄️ createServerGroup

Creates a new server group within a trust domain.

📄️ createTrustDomain

Creates a new trust domain for organizing server groups and certificate trust relationships.

📄️ createUserInvitation

Creates an invitation link for adding a new user. The invitation expires after approximately 10 minutes.

📄️ createZoomTeamChatIntegration

Creates a Zoom Team Chat integration for sending notifications to Zoom channels.

📄️ deleteCertificates

Delete one or more retired certificates.

📄️ deleteCloudKeystore

Deletes one or more cloud keystores by their IDs.

📄️ deleteCloudMachineIdentities

Deletes one or more cloud machine identities.

📄️ deleteCloudProvider

Deletes one or more cloud providers by their IDs.

📄️ deleteCluster

Deletes one or more clusters by their IDs.

📄️ deleteCodeSignSigningKey

Delete one or more Code Sign Signing Keys

📄️ deleteCompliancePolicy

Deletes one or more compliance policies by their IDs.

📄️ deleteExternalEmailRecipients

Deletes one or more external email recipients by their email addresses.

📄️ deleteIntegrations

Deletes one or more integrations by their IDs.

📄️ deleteNotificationRouter

Deletes one or more notification routers.

📄️ deleteNotificationRouting

Deletes a notification routing configuration.

📄️ enableCodeSignSigningKey

Enable or disable one or more Code Sign Signing Key

📄️ evaluateCompliancePolicy

Triggers an evaluation of a compliance policy against the current certificate inventory.

📄️ provisionToCloudKeystore

Provisions a certificate to a cloud keystore (e.g., AWS ACM, Azure Key Vault, GCP Certificate Manager).

📄️ provisionToCloudMachineIdentity

Provisions a certificate to an existing cloud machine identity. If certificateId is omitted, re-provisions the currently assigned certificate.

📄️ recoverCertificates

Recover one or more retired certificates.

📄️ removeTeamMembers

Removes one or more members from a team.

📄️ renewCodeSignObjects

Renew or rotate cryptographic objects associated to a set of Code Sign

📄️ retireCertificates

Retire one or more certificates. If a current certificate (i.e. latest version of a certificate) is retired, all

📄️ revokeCertificate

Revokes a certificate by its SHA1 fingerprint. The certificate must be in an active state.

Rotates the authentication secrets for a cloud provider. For GCP with Venafi-generated keys, this rotates the key pair. For GCP with Workload Identity Federation, this rotates the key pair and exposes the new public key at the OIDC endpoint.

📄️ runReportDefinitionQuery

Runs a report definition's query to generate fresh results with the latest data.

📄️ sendEmailExample

Sends an example notification email using the current branding configuration, useful for previewing changes.

📄️ startCloudDiscovery

Starts a cloud discovery scan for a specific cloud keystore to find existing certificates and machine identities.

📄️ updateACMEServer

Updates an existing ACME Server configuration.

📄️ updateCloudKeystore

Updates an existing cloud keystore's configuration.

📄️ updateCloudProvider

Updates an existing cloud provider's configuration.

📄️ updateCluster

Updates the properties of one or more existing clusters.

📄️ updateCodeSignConfiguration

Modify the current Code Sign configuration.

📄️ updateCodeSignProject

Update a Code Sign Project

📄️ updateCodeSignSigningKey

Update a Code Sign Signing Key

📄️ updateCompliancePolicy

Updates one or more existing compliance policies.

📄️ updateExternalEmailRecipient

Updates an existing external email recipient.

📄️ updateNetworkDiscovery

Update an existing integration service.

📄️ updateNotificationBranding

Updates the notification branding configuration (logo, colors, and custom text) for the tenant.

📄️ updateNotificationRouter

Updates an existing notification router.

📄️ updateNotificationRoutingConfiguration

Updates an existing notification routing configuration.

📄️ updatePagerDutyIntegration

Updates an existing PagerDuty integration configuration.

📄️ updateReportDefinition

Updates an existing report definition.

📄️ updateServerGroup

Updates an existing server group.

📄️ updateTrustDomain

Updates an existing trust domain.

📄️ updateUserAccountType

Updates a user's account type (e.g., from user to API service account).

📄️ updateUserEnabled

Enables or disables a user account.

📄️ updateUserForceLocalPasswordExpiration

Forces or un-forces a user's local password to expire on next login.

📄️ updateUserLocalLoginDisabled

Enables or disables the local login option for a user (as opposed to SSO-only login).

📄️ updateUserRoles

Replaces a user's roles with the specified set. Currently only one role assignment is supported.

📄️ updateZoomTeamChatIntegration

Updates an existing Zoom Team Chat integration configuration.

📄️ validateCloudProvider

Validates a cloud provider's configuration and connectivity.