AXIAM PHP SDK

SamlIdpCredential
in package
implements JsonSerializable

FinalYes

The tenant's IdP signing credential, **public facts only**. There is no key on it and no field a key could be put in: the private key is generated by the server, sealed at rest, never returned by any route and destroyed on retirement (D-21).

Table of Contents

Interfaces

JsonSerializable

Properties

$certificatePem  : string
$createdAt  : string
$fingerprint  : string
$id  : string
$issuerCaId  : string
$notAfter  : string
$notBefore  : string
$retiredAt  : string|null
$serial  : string
$status  : SamlIdpCredentialStatus
$tenantId  : string

Methods

__construct()  : mixed
Constructs a SamlIdpCredential.
fromArray()  : self
Rebuilds a SamlIdpCredential from one decoded JSON object.
jsonSerialize()  : array<string, mixed>
Renders this object for `json_encode()`.
toArray()  : array<string, mixed>
Renders this object back to its wire form.
unknownEnumValue()  : string|null
The string the server sent for an open-enum member this SDK has no name for, or `null`.

Properties

Methods

__construct()

Constructs a SamlIdpCredential.

public __construct(string $certificatePem, string $createdAt, string $fingerprint, string $id, string $issuerCaId, string $notAfter, string $notBefore, string $serial, SamlIdpCredentialStatus $status, string $tenantId[, string|null $retiredAt = null ]) : mixed
Parameters
$certificatePem : string

The leaf certificate, PEM. Public: it is what the metadata publishes.

$createdAt : string

When the credential was issued.

$fingerprint : string

Lower-case hex SHA-256 of the certificate's DER — what an SP administrator compares out of band.

$id : string

Credential id.

$issuerCaId : string

The signing CA that issued the leaf.

$notAfter : string

End of the certificate's validity (at most 730 days after the start).

$notBefore : string

Start of the certificate's validity.

$serial : string

The certificate's serial, lower-case hex.

$status : SamlIdpCredentialStatus

active, next or retired. At most one active and one next per tenant.

$tenantId : string

The tenant it signs for.

$retiredAt : string|null = null

When it was retired, or null. (optional)

fromArray()

Rebuilds a SamlIdpCredential from one decoded JSON object.

public static fromArray(array<string, mixed> $data) : self
Parameters
$data : array<string, mixed>

The raw wire object.

Return values
self

jsonSerialize()

Renders this object for `json_encode()`.

public jsonSerialize() : array<string, mixed>

Any Sensitive it carries stays WRAPPED here, so a log line or a json_encode($model) in application code prints [SENSITIVE]. The one place a secret is revealed is ManagementTransport, on the way to the wire and nowhere else (§27.5).

Rendering for a log line never fails: an unknown union arm renders its discriminator and an unrecognised enum value its empty Unknown spelling here, and only self::toArray() -- the request path -- refuses to send it (CONTRACT.md §31.2, §34.2 P12.2).

Return values
array<string, mixed>

toArray()

Renders this object back to its wire form.

public toArray() : array<string, mixed>

§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.

Return values
array<string, mixed>

unknownEnumValue()

The string the server sent for an open-enum member this SDK has no name for, or `null`.

public unknownEnumValue(string $wire) : string|null

Only a model decoded by self::fromArray() knows it, and only for a member that decoded to Unknown (CONTRACT.md §27.6.2 item 4, §34.8 (c)): it lets a refusal name the value. It is for messages -- it is never rendered by self::toArray() or self::jsonSerialize() and so is never sent.

Parameters
$wire : string

The member's wire name.

Return values
string|null
On this page

Search results