From f500172f87c1a94438188639f113e8de6961b7a8 Mon Sep 17 00:00:00 2001
From: Jimmy Phan <jimmy@Jimmys-MacBook-Air.local>
Date: Thu, 26 Jan 2023 13:10:08 -0800
Subject: [PATCH 1/9] Add app attestation and assertion api documentation.

This adds attestation and assertion documentation. Attestation is the verifying
an app is a valid instance of an iOS app and assertion is requesting a secret
of some kind after attestation is verified, in this case X.509 certificates
that can be used for client authentication.

Add response to successful assertion.
---
 .gitignore                                    |   1 +
 reference/auth.v1.yaml                        | 114 ++++++++++++++++++
 reference/auth/models/appchallenge.v1.yaml    |   7 ++
 reference/auth/models/assertionsecret.v1.yaml |  20 +++
 reference/auth/models/assertionverify.v1.yaml |  30 +++++
 .../auth/models/attestationverify.v1.yaml     |  18 +++
 reference/auth/models/coastaldata.v1.yaml     |  24 ++++
 reference/auth/models/keyid.v1.yaml           |   3 +
 reference/auth/models/newappchallenge.v1.yaml |   9 ++
 reference/common/models/base64.v1.yaml        |   4 +
 10 files changed, 230 insertions(+)
 create mode 100644 reference/auth/models/appchallenge.v1.yaml
 create mode 100644 reference/auth/models/assertionsecret.v1.yaml
 create mode 100644 reference/auth/models/assertionverify.v1.yaml
 create mode 100644 reference/auth/models/attestationverify.v1.yaml
 create mode 100644 reference/auth/models/coastaldata.v1.yaml
 create mode 100644 reference/auth/models/keyid.v1.yaml
 create mode 100644 reference/auth/models/newappchallenge.v1.yaml
 create mode 100644 reference/common/models/base64.v1.yaml

diff --git a/.gitignore b/.gitignore
index 3360b535..7679d679 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 dist
 build
 .idea/
+.DS_Store
diff --git a/reference/auth.v1.yaml b/reference/auth.v1.yaml
index 3171324e..e08b65e2 100644
--- a/reference/auth.v1.yaml
+++ b/reference/auth.v1.yaml
@@ -39,6 +39,10 @@ tags:
     description: >-
       List and manage users.
 
+  - name: Attestation
+    description: >-
+      Attest and assert an app is a valid instance of an iOS app.
+
 paths:
   '/auth/login':
     post:
@@ -719,6 +723,98 @@ paths:
       security:
         - serverToken: []
 
+  '/v1/attestations/challenges':
+    post:
+      operationId: CreateAttestationChallenge
+      summary: Create an attestation challenge.
+      description: >-
+        Starts the attestation flow by requesting an attestation challenge that the client will later use in an Apple API call and to verify an attestation.
+      requestBody:
+        content:
+          'application/json':
+            schema:
+              $ref: './auth/models/newappchallenge.v1.yaml'
+      responses:
+        '201':
+          $ref: '#/components/responses/AppChallenge'
+        '400':
+          $ref: './common/responses/badrequest.v1.yaml'
+        '401':
+          $ref: './common/responses/unauthorized.v1.yaml'
+        '403':
+          $ref: './common/responses/forbidden.v1.yaml'
+      tags:
+        - Attestation
+
+  '/v1/attestations/verifications':
+    post:
+      operationId: VerifyAttestation
+      summary: Verify an attestation.
+      description: >-
+        This confirms the app is a valid instance of an iOS app. It must use the previously generated challenge.
+      requestBody:
+        content:
+          'application/json':
+            schema:
+              $ref: './auth/models/attestationverify.v1.yaml'
+      responses:
+        '204':
+          description: The attestation was verified successfully.
+        '400':
+          $ref: './common/responses/badrequest.v1.yaml'
+        '401':
+          $ref: './common/responses/unauthorized.v1.yaml'
+        '403':
+          $ref: './common/responses/forbidden.v1.yaml'
+      tags:
+        - Attestation
+
+  '/v1/assertions/challenges':
+    post:
+      operationId: CreateAssertionChallenge
+      summary: Create an assertion challenge.
+      description: >-
+        Requests an assertion challenge be generated. This can only happen after attestation has been verified.
+      requestBody:
+        content:
+          'application/json':
+            schema:
+              $ref: './auth/models/newappchallenge.v1.yaml'
+      responses:
+        '201':
+          $ref: '#/components/responses/AppChallenge'
+        '400':
+          $ref: './common/responses/badrequest.v1.yaml'
+        '401':
+          $ref: './common/responses/unauthorized.v1.yaml'
+        '403':
+          $ref: './common/responses/forbidden.v1.yaml'
+      tags:
+        - Attestation
+
+  '/v1/assertions/verifications':
+    post:
+      operationId: VerifyAssertion
+      summary: Verify an assertion.
+      description: >-
+        This verifies an assertion and returns X.509 certficates.
+      requestBody:
+        content:
+          'application/json':
+            schema:
+              $ref: './auth/models/assertionverify.v1.yaml'
+      responses:
+        '200':
+          $ref: '#/components/responses/Assertion'
+        '400':
+          $ref: './common/responses/badrequest.v1.yaml'
+        '401':
+          $ref: './common/responses/unauthorized.v1.yaml'
+        '403':
+          $ref: './common/responses/forbidden.v1.yaml'
+      tags:
+        - Attestation
+
 components:
   securitySchemes:
     basicAuth:
@@ -998,3 +1094,21 @@ components:
                 required:
                   - code
                   - reason
+    AppChallenge:
+      description: 'Challenge generated by server and which client should use in later operations.'
+      headers:
+        'X-Tidepool-Session-Token':
+          $ref: './common/headers/tidepoolsessiontoken.v1.yaml'
+      content:
+        'application/json':
+          schema:
+            $ref: './auth/models/appchallenge.v1.yaml'
+    Assertion:
+      description: 'Certificates returned upon successful assertion.'
+      headers:
+        'X-Tidepool-Session-Token':
+          $ref: './common/headers/tidepoolsessiontoken.v1.yaml'
+      content:
+        'application/json':
+          schema:
+            $ref: './auth/models/assertionsecret.v1.yaml'
\ No newline at end of file
diff --git a/reference/auth/models/appchallenge.v1.yaml b/reference/auth/models/appchallenge.v1.yaml
new file mode 100644
index 00000000..0e3c306d
--- /dev/null
+++ b/reference/auth/models/appchallenge.v1.yaml
@@ -0,0 +1,7 @@
+title: Challenge
+description: Challenge generated by server.
+type: object
+properties:
+  challenge:
+    type: string
+    minLength: 1
diff --git a/reference/auth/models/assertionsecret.v1.yaml b/reference/auth/models/assertionsecret.v1.yaml
new file mode 100644
index 00000000..0a919906
--- /dev/null
+++ b/reference/auth/models/assertionsecret.v1.yaml
@@ -0,0 +1,20 @@
+title: AssertionSecret
+description: Data sent back upon successful app assertion. This will include X.509 certificates.
+type: object
+properties:
+  certificates:
+    description: X.509 certificates to be used for client authentication.
+    type: array
+    items:
+      type: object
+      properties:
+        content:
+          type: string
+          description: base64 encoded X.509 certificate in DER format.
+        ttlInDays:
+          type: integer
+        type:
+          type: string
+          oneOf:
+            - CONSTRAINED
+            - WILDCARD
\ No newline at end of file
diff --git a/reference/auth/models/assertionverify.v1.yaml b/reference/auth/models/assertionverify.v1.yaml
new file mode 100644
index 00000000..2a7c6f9f
--- /dev/null
+++ b/reference/auth/models/assertionverify.v1.yaml
@@ -0,0 +1,30 @@
+title: Assertion Verify
+description: Request body for verifying an assertion.
+type: object
+properties:
+  assertion:
+    $ref: '../../common/models/base64.v1.yaml'
+    description: Base64 encoded data received from Apple App Attest API. User must base64 encode the binary data received from Apple.
+  clientData:
+    type: object
+    properties:
+      challenge:
+        type: string
+        minLength: 1
+      partner:
+        description: Code name of partner to retrieve certificate from.
+        type: string
+        minLength: 1
+        enum:
+          - Coastal
+      partnerData:
+        description: Actual data to send to partner API.
+        $ref: './coastaldata.v1.yaml'
+    description: Actual data requested by client. Must include the previously requested challenge.
+  keyId:
+    $ref: './keyid.v1.yaml'
+    description: Base64 encoded key Id received from Apple App Attest API.
+required:
+  - attestation
+  - clientData
+  - keyId
diff --git a/reference/auth/models/attestationverify.v1.yaml b/reference/auth/models/attestationverify.v1.yaml
new file mode 100644
index 00000000..e4df04e3
--- /dev/null
+++ b/reference/auth/models/attestationverify.v1.yaml
@@ -0,0 +1,18 @@
+title: Attestation Verify
+description: Request body for verifying an attestation.
+type: object
+properties:
+  attestation:
+    $ref: '../../common/models/base64.v1.yaml'
+    description: Base64 encoded data received from Apple App Attest API. User must base64 encode the binary data received from Apple.
+  challenge:
+    type: string
+    minLength: 1
+    description: Challenge string returned from the Tidepool platform API.
+  keyId:
+    $ref: './keyid.v1.yaml'
+    description: Base64 encoded key Id received from Apple App Attest API.
+required:
+  - attestation
+  - challenge
+  - keyId
diff --git a/reference/auth/models/coastaldata.v1.yaml b/reference/auth/models/coastaldata.v1.yaml
new file mode 100644
index 00000000..187c06cb
--- /dev/null
+++ b/reference/auth/models/coastaldata.v1.yaml
@@ -0,0 +1,24 @@
+title: CoastalData
+description: Data to send to Coastal's API.
+type: object
+properties:
+  rcTypeId:
+    type: string
+  rcInstanceId:
+    type: string
+  rcHWVersions:
+    type: array
+    items:
+      type: string
+  rcSWVersions:
+    type: array
+    items:
+      type: string
+  phdTypeId:
+    type: string
+  phdInstanceId:
+    type: string
+  csr:
+    type: string
+  rcbMac:
+    type: string
diff --git a/reference/auth/models/keyid.v1.yaml b/reference/auth/models/keyid.v1.yaml
new file mode 100644
index 00000000..59fbd1f2
--- /dev/null
+++ b/reference/auth/models/keyid.v1.yaml
@@ -0,0 +1,3 @@
+title: Key Id
+description: Base64 encoded key identifier received from apple. The Key Id is some shortened data, usually a hash, used to identify the longer actual key.
+$ref: '../../common/models/base64.v1.yaml'
diff --git a/reference/auth/models/newappchallenge.v1.yaml b/reference/auth/models/newappchallenge.v1.yaml
new file mode 100644
index 00000000..2f0c2014
--- /dev/null
+++ b/reference/auth/models/newappchallenge.v1.yaml
@@ -0,0 +1,9 @@
+title: New App Challenge
+description: Information needed when generating an attestation or assertion challenge.
+type: object
+properties:
+  keyId:
+    $ref: '../../common/models/base64.v1.yaml'
+    description: Base64 encoded key Id received from Apple App Attest API.
+required:
+  - keyId
diff --git a/reference/common/models/base64.v1.yaml b/reference/common/models/base64.v1.yaml
new file mode 100644
index 00000000..8d841293
--- /dev/null
+++ b/reference/common/models/base64.v1.yaml
@@ -0,0 +1,4 @@
+title: Base64
+type: string
+description: Base64 encoded data.
+pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'

From 32c274be29baa347c1c80d66e758f503f0012e80 Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Mon, 24 Jul 2023 13:10:53 -0700
Subject: [PATCH 2/9] Fix typo.

---
 reference/auth/models/assertionsecret.v1.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reference/auth/models/assertionsecret.v1.yaml b/reference/auth/models/assertionsecret.v1.yaml
index 0a919906..089feb48 100644
--- a/reference/auth/models/assertionsecret.v1.yaml
+++ b/reference/auth/models/assertionsecret.v1.yaml
@@ -15,6 +15,6 @@ properties:
           type: integer
         type:
           type: string
-          oneOf:
+          enum:
             - CONSTRAINED
             - WILDCARD
\ No newline at end of file

From 952bc615e9f5ebde33be26bd82e9e9e8788f6a8a Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Mon, 24 Jul 2023 13:32:46 -0700
Subject: [PATCH 3/9] Update descriptions.

---
 reference/auth/models/assertionverify.v1.yaml   | 1 +
 reference/auth/models/attestationverify.v1.yaml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/reference/auth/models/assertionverify.v1.yaml b/reference/auth/models/assertionverify.v1.yaml
index 2a7c6f9f..e2704982 100644
--- a/reference/auth/models/assertionverify.v1.yaml
+++ b/reference/auth/models/assertionverify.v1.yaml
@@ -9,6 +9,7 @@ properties:
     type: object
     properties:
       challenge:
+        description: The previously returned assertion challenge.
         type: string
         minLength: 1
       partner:
diff --git a/reference/auth/models/attestationverify.v1.yaml b/reference/auth/models/attestationverify.v1.yaml
index e4df04e3..ab215daa 100644
--- a/reference/auth/models/attestationverify.v1.yaml
+++ b/reference/auth/models/attestationverify.v1.yaml
@@ -8,7 +8,7 @@ properties:
   challenge:
     type: string
     minLength: 1
-    description: Challenge string returned from the Tidepool platform API.
+    description: The previously returned attestation challenge.
   keyId:
     $ref: './keyid.v1.yaml'
     description: Base64 encoded key Id received from Apple App Attest API.

From 548cbce8530a9c426549fea0a510d6190efd1304 Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Tue, 25 Jul 2023 08:56:10 -0700
Subject: [PATCH 4/9] Update partner body fields.

---
 reference/auth/models/coastaldata.v1.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/reference/auth/models/coastaldata.v1.yaml b/reference/auth/models/coastaldata.v1.yaml
index 187c06cb..2183ddb2 100644
--- a/reference/auth/models/coastaldata.v1.yaml
+++ b/reference/auth/models/coastaldata.v1.yaml
@@ -4,8 +4,10 @@ type: object
 properties:
   rcTypeId:
     type: string
+    minLength: 1
   rcInstanceId:
     type: string
+    minLength: 1
   rcHWVersions:
     type: array
     items:
@@ -16,9 +18,15 @@ properties:
       type: string
   phdTypeId:
     type: string
+    minLength: 1
   phdInstanceId:
     type: string
+    minLength: 1
   csr:
-    type: string
+    $ref: '../../common/models/base64.v1.yaml'
+    description: Base64 encoded string of the PEM formatted certificate signing request to the partner API.
+    minLength: 1
   rcbMac:
     type: string
+    description: Deprecated field that will be removed in the future but currently required by partner. Value can be any non empty string.
+    minLength: 1

From eb24cf9c201271e4f43afabd4d39d1a88889d8b7 Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Tue, 25 Jul 2023 08:58:17 -0700
Subject: [PATCH 5/9] format

---
 reference/auth/models/assertionsecret.v1.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/reference/auth/models/assertionsecret.v1.yaml b/reference/auth/models/assertionsecret.v1.yaml
index 089feb48..72e2b59a 100644
--- a/reference/auth/models/assertionsecret.v1.yaml
+++ b/reference/auth/models/assertionsecret.v1.yaml
@@ -9,7 +9,7 @@ properties:
       type: object
       properties:
         content:
-          type: string
+          $ref: '../../common/models/base64.v1.yaml'
           description: base64 encoded X.509 certificate in DER format.
         ttlInDays:
           type: integer

From fb66302ddbe060ebd517108e1bfe129b454d6a53 Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Thu, 31 Aug 2023 11:20:51 -0700
Subject: [PATCH 6/9] Update api for palmtree.

---
 reference/auth/models/assertionsecret.v1.yaml | 24 ++++------------
 reference/auth/models/assertionverify.v1.yaml |  9 ++++--
 .../auth/models/attestationverify.v1.yaml     |  4 +--
 ...taldata.v1.yaml => coastalrequest.v1.yaml} | 14 +++-------
 reference/auth/models/coastalresponse.v1.yaml | 21 ++++++++++++++
 reference/auth/models/keyid.v1.yaml           |  3 +-
 reference/auth/models/newappchallenge.v1.yaml |  3 +-
 reference/auth/models/palmtreerequest.v1.yaml |  5 ++++
 .../auth/models/palmtreeresponse.v1.yaml      | 28 +++++++++++++++++++
 9 files changed, 76 insertions(+), 35 deletions(-)
 rename reference/auth/models/{coastaldata.v1.yaml => coastalrequest.v1.yaml} (61%)
 create mode 100644 reference/auth/models/coastalresponse.v1.yaml
 create mode 100644 reference/auth/models/palmtreerequest.v1.yaml
 create mode 100644 reference/auth/models/palmtreeresponse.v1.yaml

diff --git a/reference/auth/models/assertionsecret.v1.yaml b/reference/auth/models/assertionsecret.v1.yaml
index 72e2b59a..286cf16b 100644
--- a/reference/auth/models/assertionsecret.v1.yaml
+++ b/reference/auth/models/assertionsecret.v1.yaml
@@ -1,20 +1,8 @@
-title: AssertionSecret
-description: Data sent back upon successful app assertion. This will include X.509 certificates.
+title: Assertion Secret
+description: Data sent back upon successful app assertion.
 type: object
 properties:
-  certificates:
-    description: X.509 certificates to be used for client authentication.
-    type: array
-    items:
-      type: object
-      properties:
-        content:
-          $ref: '../../common/models/base64.v1.yaml'
-          description: base64 encoded X.509 certificate in DER format.
-        ttlInDays:
-          type: integer
-        type:
-          type: string
-          enum:
-            - CONSTRAINED
-            - WILDCARD
\ No newline at end of file
+  data:
+    oneOf:
+      - $ref: './coastalresponse.v1.yaml'
+      - $ref: './palmtreeresponse.v1.yaml'
\ No newline at end of file
diff --git a/reference/auth/models/assertionverify.v1.yaml b/reference/auth/models/assertionverify.v1.yaml
index e2704982..d27f23a1 100644
--- a/reference/auth/models/assertionverify.v1.yaml
+++ b/reference/auth/models/assertionverify.v1.yaml
@@ -3,7 +3,8 @@ description: Request body for verifying an assertion.
 type: object
 properties:
   assertion:
-    $ref: '../../common/models/base64.v1.yaml'
+    type: string
+    pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
     description: Base64 encoded data received from Apple App Attest API. User must base64 encode the binary data received from Apple.
   clientData:
     type: object
@@ -18,9 +19,11 @@ properties:
         minLength: 1
         enum:
           - Coastal
+          - PalmTree
       partnerData:
-        description: Actual data to send to partner API.
-        $ref: './coastaldata.v1.yaml'
+        oneOf:
+          - $ref: './coastalrequest.v1.yaml'
+          - $ref: './palmtreerequest.v1.yaml'
     description: Actual data requested by client. Must include the previously requested challenge.
   keyId:
     $ref: './keyid.v1.yaml'
diff --git a/reference/auth/models/attestationverify.v1.yaml b/reference/auth/models/attestationverify.v1.yaml
index ab215daa..6a785352 100644
--- a/reference/auth/models/attestationverify.v1.yaml
+++ b/reference/auth/models/attestationverify.v1.yaml
@@ -3,7 +3,8 @@ description: Request body for verifying an attestation.
 type: object
 properties:
   attestation:
-    $ref: '../../common/models/base64.v1.yaml'
+    type: string
+    pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
     description: Base64 encoded data received from Apple App Attest API. User must base64 encode the binary data received from Apple.
   challenge:
     type: string
@@ -11,7 +12,6 @@ properties:
     description: The previously returned attestation challenge.
   keyId:
     $ref: './keyid.v1.yaml'
-    description: Base64 encoded key Id received from Apple App Attest API.
 required:
   - attestation
   - challenge
diff --git a/reference/auth/models/coastaldata.v1.yaml b/reference/auth/models/coastalrequest.v1.yaml
similarity index 61%
rename from reference/auth/models/coastaldata.v1.yaml
rename to reference/auth/models/coastalrequest.v1.yaml
index 2183ddb2..25ef8f9e 100644
--- a/reference/auth/models/coastaldata.v1.yaml
+++ b/reference/auth/models/coastalrequest.v1.yaml
@@ -1,10 +1,7 @@
-title: CoastalData
+title: Coastal Request Data
 description: Data to send to Coastal's API.
 type: object
 properties:
-  rcTypeId:
-    type: string
-    minLength: 1
   rcInstanceId:
     type: string
     minLength: 1
@@ -23,10 +20,7 @@ properties:
     type: string
     minLength: 1
   csr:
-    $ref: '../../common/models/base64.v1.yaml'
-    description: Base64 encoded string of the PEM formatted certificate signing request to the partner API.
-    minLength: 1
-  rcbMac:
     type: string
-    description: Deprecated field that will be removed in the future but currently required by partner. Value can be any non empty string.
-    minLength: 1
+    pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
+    description: Base64 encoded string of the PEM formatted certificate signing request to the partner API.
+    minLength: 1
\ No newline at end of file
diff --git a/reference/auth/models/coastalresponse.v1.yaml b/reference/auth/models/coastalresponse.v1.yaml
new file mode 100644
index 00000000..478cf285
--- /dev/null
+++ b/reference/auth/models/coastalresponse.v1.yaml
@@ -0,0 +1,21 @@
+title: Coastal Response
+description: Data retrieved from Coastal's API.
+type: object
+properties:
+  certificates:
+    description: X.509 certificates to be used for client authentication.
+    type: array
+    items:
+      type: object
+      properties:
+        content:
+          type: string
+          pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
+          description: base64 encoded X.509 certificate in DER format.
+        ttlInDays:
+          type: integer
+        type:
+          type: string
+          enum:
+            - CONSTRAINED
+            - WILDCARD
\ No newline at end of file
diff --git a/reference/auth/models/keyid.v1.yaml b/reference/auth/models/keyid.v1.yaml
index 59fbd1f2..248a7f91 100644
--- a/reference/auth/models/keyid.v1.yaml
+++ b/reference/auth/models/keyid.v1.yaml
@@ -1,3 +1,4 @@
 title: Key Id
 description: Base64 encoded key identifier received from apple. The Key Id is some shortened data, usually a hash, used to identify the longer actual key.
-$ref: '../../common/models/base64.v1.yaml'
+type: string
+pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
diff --git a/reference/auth/models/newappchallenge.v1.yaml b/reference/auth/models/newappchallenge.v1.yaml
index 2f0c2014..b8001001 100644
--- a/reference/auth/models/newappchallenge.v1.yaml
+++ b/reference/auth/models/newappchallenge.v1.yaml
@@ -3,7 +3,8 @@ description: Information needed when generating an attestation or assertion chal
 type: object
 properties:
   keyId:
-    $ref: '../../common/models/base64.v1.yaml'
+    type: string
+    pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
     description: Base64 encoded key Id received from Apple App Attest API.
 required:
   - keyId
diff --git a/reference/auth/models/palmtreerequest.v1.yaml b/reference/auth/models/palmtreerequest.v1.yaml
new file mode 100644
index 00000000..0722ac63
--- /dev/null
+++ b/reference/auth/models/palmtreerequest.v1.yaml
@@ -0,0 +1,5 @@
+title: Palm Tree Request Data
+description: Data to send to Palm Tree's API.
+type: object
+properties:
+- name: csr
\ No newline at end of file
diff --git a/reference/auth/models/palmtreeresponse.v1.yaml b/reference/auth/models/palmtreeresponse.v1.yaml
new file mode 100644
index 00000000..3c7fd439
--- /dev/null
+++ b/reference/auth/models/palmtreeresponse.v1.yaml
@@ -0,0 +1,28 @@
+title: Palm Tree Response
+description: Data retrieved from Palm Tree's API.
+type: object
+properties:
+  type:
+    type: string
+  Enrolment:
+    type: object
+    properties:
+      body:
+        type: string
+        description: PEM encoded certificate.
+      id:
+        type: string
+      issuerName:
+        type: string
+      serialNumber:
+        type: string
+      subjectName:
+        type: string
+      id:
+        type: string
+      serialNumber:
+        type: string
+      status:
+        type: string
+      validityPeriod:
+        type: string
\ No newline at end of file

From 00c3f30a4a6abfc514aa5db1b871f668588838fd Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Thu, 31 Aug 2023 12:29:03 -0700
Subject: [PATCH 7/9] Fix typos.

---
 reference/auth/models/palmtreeresponse.v1.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/reference/auth/models/palmtreeresponse.v1.yaml b/reference/auth/models/palmtreeresponse.v1.yaml
index 3c7fd439..43d76301 100644
--- a/reference/auth/models/palmtreeresponse.v1.yaml
+++ b/reference/auth/models/palmtreeresponse.v1.yaml
@@ -4,7 +4,7 @@ type: object
 properties:
   type:
     type: string
-  Enrolment:
+  enrollment:
     type: object
     properties:
       body:
@@ -18,8 +18,6 @@ properties:
         type: string
       subjectName:
         type: string
-      id:
-        type: string
       serialNumber:
         type: string
       status:

From f5ca75c8d9ebd58dedf9a27d7f92ff2da4fd7bae Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Thu, 31 Aug 2023 13:16:14 -0700
Subject: [PATCH 8/9] Remove duplicate property.

---
 reference/auth/models/palmtreeresponse.v1.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/reference/auth/models/palmtreeresponse.v1.yaml b/reference/auth/models/palmtreeresponse.v1.yaml
index 43d76301..f1ff92ac 100644
--- a/reference/auth/models/palmtreeresponse.v1.yaml
+++ b/reference/auth/models/palmtreeresponse.v1.yaml
@@ -18,8 +18,6 @@ properties:
         type: string
       subjectName:
         type: string
-      serialNumber:
-        type: string
       status:
         type: string
       validityPeriod:

From b1fa3a197e760b464458d83c55e70965a686af9e Mon Sep 17 00:00:00 2001
From: lostlevels <lostlevels@users.noreply.github.com>
Date: Tue, 5 Sep 2023 13:34:36 -0700
Subject: [PATCH 9/9] Fix palmtree payload.

---
 reference/auth/models/palmtreerequest.v1.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/reference/auth/models/palmtreerequest.v1.yaml b/reference/auth/models/palmtreerequest.v1.yaml
index 0722ac63..0091da3a 100644
--- a/reference/auth/models/palmtreerequest.v1.yaml
+++ b/reference/auth/models/palmtreerequest.v1.yaml
@@ -2,4 +2,7 @@ title: Palm Tree Request Data
 description: Data to send to Palm Tree's API.
 type: object
 properties:
-- name: csr
\ No newline at end of file
+  csr:
+    description: Base64 encoded certificate signing request.
+    type: string
+    pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
\ No newline at end of file