AXIAM PHP SDK

Certificate
in package
implements JsonSerializable

FinalYes

A tenant-level certificate for users, services, or IoT devices. Certificates are signed by the organization's CA. The private key is returned once on generation and never stored by AXIAM.

Table of Contents

Interfaces

JsonSerializable

Properties

$boundServiceAccountId  : string|null
$certType  : CertificateType
$createdAt  : string
$fingerprint  : string
$id  : string
$issuerCaId  : string
$keyAlgorithm  : KeyAlgorithm
$metadata  : mixed
$notAfter  : string
$notBefore  : string
$publicCertPem  : string
$status  : CertificateStatus
$subject  : string
$tenantId  : string
$userId  : string|null

Methods

__construct()  : mixed
Constructs a Certificate.
fromArray()  : self
Rebuilds a Certificate from one decoded JSON object.
jsonSerialize()  : array<string, mixed>
Renders this object for `json_encode()`.
toArray()  : array<string, mixed>
Renders this object back to its wire form.
unknownEnumValue()  : string|null
The string the server sent for an open-enum member this SDK has no name for, or `null`.

Properties

$boundServiceAccountId read-only

public string|null $boundServiceAccountId = null

$publicCertPem read-only

public string $publicCertPem

Methods

__construct()

Constructs a Certificate.

public __construct(CertificateType $certType, string $createdAt, string $fingerprint, string $id, string $issuerCaId, KeyAlgorithm $keyAlgorithm, mixed $metadata, string $notAfter, string $notBefore, string $publicCertPem, CertificateStatus $status, string $subject, string $tenantId[, string|null $userId = null ][, string|null $boundServiceAccountId = null ]) : mixed
Parameters
$certType : CertificateType

the server's cert_type field

$createdAt : string

the server's created_at field

$fingerprint : string

SHA-256 fingerprint of the certificate.

$id : string

the server's id field

$issuerCaId : string

The CA certificate that signed this certificate.

$keyAlgorithm : KeyAlgorithm

the server's key_algorithm field

$metadata : mixed

Arbitrary key-value metadata (e.g., a device serial). Free-form and never authoritative: the account a User certificate was issued for is user_id. A metadata.user_id is still read, by the revocation of a user's certificates, for a row issued before the binding existed (schema v98, #533).

$notAfter : string

Validity end.

$notBefore : string

Validity start.

$publicCertPem : string

PEM-encoded public certificate.

$status : CertificateStatus

the server's status field

$subject : string

The certificate's common name, e.g. device-001. The normalised value: a CN= prefix in the request is understood and stripped, so this always says what the certificate's subject DN says (DF-023).

$tenantId : string

The tenant this certificate belongs to.

$userId : string|null = null

The user account a User certificate was issued for, in this tenant (#533); null for every other type, for a User certificate issued without one, and for every certificate issued before schema v98. What revoking a user's certificates matches on — directory linking, administrator deletion and Art. 17 erasure. A row with None is matched by the older convention instead (metadata.user_id, or a subject common name equal to the account's username or email); a row naming another account never is. It does not make the certificate authenticate as the user: a certificate authenticates only as the service account it is bound to. (optional)

$boundServiceAccountId : string|null = null

Resolved by the list projection only. The server resolves this for a whole page in one query, so it is populated by list and is null on get (CONTRACT.md §27.11 rule 4). null there means "this read does not carry it", not "there is nothing bound" — this SDK does not issue a second request to fill it in. (optional)

fromArray()

Rebuilds a Certificate from one decoded JSON object.

public static fromArray(array<string, mixed> $data) : self
Parameters
$data : array<string, mixed>

The raw wire object.

Return values
self

jsonSerialize()

Renders this object for `json_encode()`.

public jsonSerialize() : array<string, mixed>

Any Sensitive it carries stays WRAPPED here, so a log line or a json_encode($model) in application code prints [SENSITIVE]. The one place a secret is revealed is ManagementTransport, on the way to the wire and nowhere else (§27.5).

Rendering for a log line never fails: an unknown union arm renders its discriminator and an unrecognised enum value its empty Unknown spelling here, and only self::toArray() -- the request path -- refuses to send it (CONTRACT.md §31.2, §34.2 P12.2).

Return values
array<string, mixed>

toArray()

Renders this object back to its wire form.

public toArray() : array<string, mixed>

§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.

Return values
array<string, mixed>

unknownEnumValue()

The string the server sent for an open-enum member this SDK has no name for, or `null`.

public unknownEnumValue(string $wire) : string|null

Only a model decoded by self::fromArray() knows it, and only for a member that decoded to Unknown (CONTRACT.md §27.6.2 item 4, §34.8 (c)): it lets a refusal name the value. It is for messages -- it is never rendered by self::toArray() or self::jsonSerialize() and so is never sent.

Parameters
$wire : string

The member's wire name.

Return values
string|null
On this page

Search results