devicetrustv1

type AccountUsageType int32

type AuthenticateDeviceChallenge struct {

	// Randomly-generated, opaque challenge to be signed using the device key.
	Challenge []byte `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateDeviceChallengeResponse struct {

	// Signature over the challenge, using the device key.
	Signature []byte `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateDeviceInit struct {

	// In-band user certificates to augment with device extensions.
	//   - The x509 certificate is acquired from the mTLS connection, thus the
	//     in-band certificate is ignored.
	//   - All certificates must be valid and issued by the Teleport CA.
	//   - All certificates must match (same public key, same Teleport user, plus
	//     whatever additional checks the backend sees fit).
	//   - Augmented certificates have the same expiration as the original
	//     certificates.
	UserCertificates *UserCertificates `protobuf:"bytes,1,opt,name=user_certificates,json=userCertificates,proto3" json:"user_certificates,omitempty"`
	// ID of the enrolled device credential.
	CredentialId string `protobuf:"bytes,2,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
	// Device collected data.
	// Matched against the device registration information and any previously
	// collected data.
	DeviceData *DeviceCollectedData `protobuf:"bytes,3,opt,name=device_data,json=deviceData,proto3" json:"device_data,omitempty"`
	// If present, on-behalf-of device authentication is performed.
	// The user_certificates input field is ignored and no certificate data is
	// returned to the caller, instead a confirmation_token is returned in
	// the last step.
	//
	// See ConfirmDeviceWebAuthentication.
	DeviceWebToken *DeviceWebToken `protobuf:"bytes,4,opt,name=device_web_token,json=deviceWebToken,proto3" json:"device_web_token,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateDeviceRequest struct {

	// Types that are assignable to Payload:
	//
	//	*AuthenticateDeviceRequest_Init
	//	*AuthenticateDeviceRequest_ChallengeResponse
	//	*AuthenticateDeviceRequest_TpmChallengeResponse
	Payload isAuthenticateDeviceRequest_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type AuthenticateDeviceRequest_ChallengeResponse struct {
	ChallengeResponse *AuthenticateDeviceChallengeResponse `protobuf:"bytes,2,opt,name=challenge_response,json=challengeResponse,proto3,oneof"`
}

type AuthenticateDeviceRequest_Init struct {
	Init *AuthenticateDeviceInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type AuthenticateDeviceRequest_TpmChallengeResponse struct {
	TpmChallengeResponse *TPMAuthenticateDeviceChallengeResponse `protobuf:"bytes,3,opt,name=tpm_challenge_response,json=tpmChallengeResponse,proto3,oneof"`
}

type AuthenticateDeviceResponse struct {

	// Types that are assignable to Payload:
	//
	//	*AuthenticateDeviceResponse_Challenge
	//	*AuthenticateDeviceResponse_UserCertificates
	//	*AuthenticateDeviceResponse_TpmChallenge
	//	*AuthenticateDeviceResponse_ConfirmationToken
	Payload isAuthenticateDeviceResponse_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type AuthenticateDeviceResponse_Challenge struct {
	Challenge *AuthenticateDeviceChallenge `protobuf:"bytes,1,opt,name=challenge,proto3,oneof"`
}

type AuthenticateDeviceResponse_ConfirmationToken struct {
	// A confirmation token is returned as the result of a successful device web
	// authentication.
	//
	// See AuthenticateDeviceInit.device_web_token.
	ConfirmationToken *DeviceConfirmationToken `protobuf:"bytes,4,opt,name=confirmation_token,json=confirmationToken,proto3,oneof"`
}

type AuthenticateDeviceResponse_TpmChallenge struct {
	TpmChallenge *TPMAuthenticateDeviceChallenge `protobuf:"bytes,3,opt,name=tpm_challenge,json=tpmChallenge,proto3,oneof"`
}

type AuthenticateDeviceResponse_UserCertificates struct {
	// User certificates are returned as the result of a successful device
	// authentication attempt ("regular" or non-web authentication).
	UserCertificates *UserCertificates `protobuf:"bytes,2,opt,name=user_certificates,json=userCertificates,proto3,oneof"`
}

type BulkCreateDevicesRequest struct {

	// Devices to create.
	Devices []*Device `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// If true, create the device as a Teleport resource, meaning that fields that
	// are usually considered read-only or system managed are copied as provided
	// to storage.
	// Prefer using non-resource creation semantics if possible.
	CreateAsResource bool `protobuf:"varint,2,opt,name=create_as_resource,json=createAsResource,proto3" json:"create_as_resource,omitempty"`
	// contains filtered or unexported fields
}

type BulkCreateDevicesResponse struct {

	// Created devices or a failure reason.
	// Responses are sorted according to the request.
	Devices []*DeviceOrStatus `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// contains filtered or unexported fields
}

type ConfirmDeviceWebAuthenticationRequest struct {

	// Confirmation token to be spent.
	ConfirmationToken *DeviceConfirmationToken `protobuf:"bytes,1,opt,name=confirmation_token,json=confirmationToken,proto3" json:"confirmation_token,omitempty"`
	// Web Session identifier of the session that started this request, via
	// Teleport Proxy.
	//
	// For the request to be successful the Web Session must match the session
	// that started the authentication attempt.
	CurrentWebSessionId string `protobuf:"bytes,2,opt,name=current_web_session_id,json=currentWebSessionId,proto3" json:"current_web_session_id,omitempty"`
	// contains filtered or unexported fields
}

type ConfirmDeviceWebAuthenticationResponse struct {
	// contains filtered or unexported fields
}

type CreateDeviceEnrollTokenRequest struct {

	// ID of the device.
	DeviceId string `protobuf:"bytes,1,opt,name=device_id,json=deviceId,proto3" json:"device_id,omitempty"`
	// Device collected data.
	// Used to authorize issuance of device enrollment tokens for auto-enrollment.
	// Not required otherwise.
	DeviceData *DeviceCollectedData `protobuf:"bytes,2,opt,name=device_data,json=deviceData,proto3" json:"device_data,omitempty"`
	// Custom expiration time for enrollment tokens.
	// A short (for humans) server default is used if unset.
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

type CreateDeviceRequest struct {

	// Device to create.
	Device *Device `protobuf:"bytes,1,opt,name=device,proto3" json:"device,omitempty"`
	// If true, a DeviceEnrollToken is created along with the Device.
	CreateEnrollToken bool `protobuf:"varint,2,opt,name=create_enroll_token,json=createEnrollToken,proto3" json:"create_enroll_token,omitempty"`
	// If true, create the device as a Teleport resource, meaning that fields that
	// are usually considered read-only or system managed are copied as provided
	// to storage.
	// Prefer using non-resource creation semantics if possible.
	CreateAsResource bool `protobuf:"varint,3,opt,name=create_as_resource,json=createAsResource,proto3" json:"create_as_resource,omitempty"`
	// Custom expiration time for enrollment tokens.
	// A short (for humans) server default is used if unset.
	EnrollTokenExpireTime *timestamppb.Timestamp `` /* 128-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DeleteDeviceRequest struct {

	// ID of the Device to delete.
	DeviceId string `protobuf:"bytes,1,opt,name=device_id,json=deviceId,proto3" json:"device_id,omitempty"`
	// contains filtered or unexported fields
}

type Device struct {

	// API version of the Device definition, present for compatibility with
	// types.DeviceV1.
	// Always "v1".
	ApiVersion string `protobuf:"bytes,1,opt,name=api_version,json=apiVersion,proto3" json:"api_version,omitempty"`
	// Unique device identifier.
	// System managed.
	Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
	// Device operating system.
	// Required.
	OsType OSType `protobuf:"varint,3,opt,name=os_type,json=osType,proto3,enum=teleport.devicetrust.v1.OSType" json:"os_type,omitempty"`
	// Device inventory identifier.
	// Takes different meanings depending on the device and operating system.
	// For macOS devices it is the device serial number.
	// Required.
	AssetTag string `protobuf:"bytes,4,opt,name=asset_tag,json=assetTag,proto3" json:"asset_tag,omitempty"`
	// Create time.
	// System managed.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Last update time.
	// System managed.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// Enrollment token for the device.
	// Only present in situations where device creation and enrollment are rolled
	// into a single operation.
	// Transient.
	EnrollToken *DeviceEnrollToken `protobuf:"bytes,7,opt,name=enroll_token,json=enrollToken,proto3" json:"enroll_token,omitempty"`
	// Enrollment status of the device.
	// May be changed to DEVICE_ENROLL_STATUS_NOT_ENROLLED at any time to
	// forcefully unenroll a device (server-side only).
	// System managed.
	EnrollStatus DeviceEnrollStatus `` /* 146-byte string literal not displayed */
	// Currently enrolled device credential.
	// Manually unenrolling a device clears the credential.
	// System managed.
	Credential *DeviceCredential `protobuf:"bytes,9,opt,name=credential,proto3" json:"credential,omitempty"`
	// Device data collected during enrollment and device authentication.
	// Enrollment data is always present, while authentication data is capped at N
	// most recent events.
	// Only present in certain read modes.
	// Transient.
	CollectedData []*DeviceCollectedData `protobuf:"bytes,10,rep,name=collected_data,json=collectedData,proto3" json:"collected_data,omitempty"`
	// Source of the device.
	// Devices managed directly via Teleport (`tctl`, Web UI, etc) have no
	// assigned source.
	Source *DeviceSource `protobuf:"bytes,11,opt,name=source,proto3" json:"source,omitempty"`
	// Device information acquired from an external source.
	Profile *DeviceProfile `protobuf:"bytes,12,opt,name=profile,proto3" json:"profile,omitempty"`
	// Device owner.
	// Usually the owner is the same user who performed the enrollment ceremony.
	// May be empty for legacy devices (Teleport v13.2 and older).
	// Manually unenrolling a device clears the owner.
	// System-managed.
	Owner string `protobuf:"bytes,13,opt,name=owner,proto3" json:"owner,omitempty"`
	// contains filtered or unexported fields
}

type DeviceAttestationType int32

type DeviceCollectedData struct {

	// Time of data collection, set by the client.
	// Required.
	CollectTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=collect_time,json=collectTime,proto3" json:"collect_time,omitempty"`
	// Time of data collection, as received by the server.
	// System managed.
	RecordTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=record_time,json=recordTime,proto3" json:"record_time,omitempty"`
	// Device operating system.
	// Required.
	OsType OSType `protobuf:"varint,3,opt,name=os_type,json=osType,proto3,enum=teleport.devicetrust.v1.OSType" json:"os_type,omitempty"`
	// Device serial number used to match the device with the inventory.
	// This field is one of the three following
	// values in this precedence:
	// - reported_asset_tag
	// - system_serial_number
	// - base_board_serial_number
	// Required.
	SerialNumber string `protobuf:"bytes,4,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
	// Non-descriptive model identifier.
	// Example: "MacBookPro9,2".
	ModelIdentifier string `protobuf:"bytes,5,opt,name=model_identifier,json=modelIdentifier,proto3" json:"model_identifier,omitempty"`
	// OS version number, without the leading 'v'.
	// Example: "13.2.1".
	OsVersion string `protobuf:"bytes,6,opt,name=os_version,json=osVersion,proto3" json:"os_version,omitempty"`
	// OS build identifier. Augments the os_version.
	// May match either the DeviceProfile os_build or os_build_supplemental.
	// Example: "22D68" or "22F770820d".
	OsBuild string `protobuf:"bytes,7,opt,name=os_build,json=osBuild,proto3" json:"os_build,omitempty"`
	// OS username (distinct from the Teleport user).
	OsUsername string `protobuf:"bytes,8,opt,name=os_username,json=osUsername,proto3" json:"os_username,omitempty"`
	// Jamf binary version, without the leading 'v'.
	// Example: "9.27" or "10.44.1-t1677509507".
	JamfBinaryVersion string `protobuf:"bytes,9,opt,name=jamf_binary_version,json=jamfBinaryVersion,proto3" json:"jamf_binary_version,omitempty"`
	// Unmodified output of `/usr/bin/profiles status -type enrollment`.
	// Used to verify the presence of an enrollment profile.
	MacosEnrollmentProfiles string `` /* 133-byte string literal not displayed */
	// The asset tag of the device as reported by the BIOS DMI Type 3. Tools
	// used by customers to manage their fleet may set this value.
	ReportedAssetTag string `protobuf:"bytes,11,opt,name=reported_asset_tag,json=reportedAssetTag,proto3" json:"reported_asset_tag,omitempty"`
	// The serial number of the "system" as reported by the BIOS DMI Type 1.
	// This field can be empty if no value has been configured.
	SystemSerialNumber string `protobuf:"bytes,12,opt,name=system_serial_number,json=systemSerialNumber,proto3" json:"system_serial_number,omitempty"`
	// The serial number of the "base board" as reported by BIOS DMI Type 2.
	// This field can be empty if no value has been configured.
	BaseBoardSerialNumber string `` /* 129-byte string literal not displayed */
	// If during the collection of this device data, the device performed a TPM
	// platform attestation (e.g during enrollment or authentication), then this
	// field holds the record of this attestation. This allows the state of the
	// device to be compared to historical state, and allows for the platform
	// attestations to be revalidated at a later date.
	//
	// This field is not explicitly sent up by the client, and any DCD sent by a
	// client including this field should be rejected. The server should inject
	// this field once verifying that the submitted platform attestation during
	// the enrollment or authentication.
	//
	// System managed.
	TpmPlatformAttestation *TPMPlatformAttestation `` /* 130-byte string literal not displayed */
	// OS identifier.
	// Mainly used to differentiate Linux distros, as there is be no variation
	// for systems like macOS or Windows.
	// Example: "ubuntu", "centos", "fedora", "rhel".
	OsId string `protobuf:"bytes,15,opt,name=os_id,json=osId,proto3" json:"os_id,omitempty"`
	// contains filtered or unexported fields
}

type DeviceConfirmationToken struct {

	// Opaque token identifier.
	// System-generated.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Opaque device confirmation token, in plaintext, encoded in
	// base64.RawURLEncoding (so it is inherently safe for URl use).
	// System-generated.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type DeviceCredential struct {

	// Unique identifier of the credential, defined client-side.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Device public key marshaled as a PKIX, ASN.1 DER. Used only on MacOS.
	PublicKeyDer []byte `protobuf:"bytes,2,opt,name=public_key_der,json=publicKeyDer,proto3" json:"public_key_der,omitempty"`
	// The degree to which the device credential is attested.
	DeviceAttestationType DeviceAttestationType `` /* 178-byte string literal not displayed */
	// For TPM devices, the serial number of the TPM endorsement certificate.
	TpmEkcertSerial string `protobuf:"bytes,4,opt,name=tpm_ekcert_serial,json=tpmEkcertSerial,proto3" json:"tpm_ekcert_serial,omitempty"`
	// For TPM devices, the encoded TPMT_PUBLIC structure containing the
	// attestation public key and signing parameters.
	TpmAkPublic []byte `protobuf:"bytes,5,opt,name=tpm_ak_public,json=tpmAkPublic,proto3" json:"tpm_ak_public,omitempty"`
	// contains filtered or unexported fields
}

type DeviceEnrollStatus int32

type DeviceEnrollToken struct {

	// Opaque enrollement token required by the EnrollDevice RPC.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Expiration time for the token.
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

type DeviceOrStatus struct {

	// Status of the operation.
	// May either be absent or contain the OK code for successes, at the
	// implementation's discretion.
	Status *status.Status `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	// ID of the created device.
	// Only present if the status is OK.
	Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
	// If true the action attempted against the device was a delete, instead of a
	// create or update.
	Deleted bool `protobuf:"varint,3,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// contains filtered or unexported fields
}

type DeviceOrigin int32

type DeviceProfile struct {

	// Latest profile update time.
	// System managed.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// Non-descriptive model identifier.
	// Example: "MacBookPro9,2".
	ModelIdentifier string `protobuf:"bytes,2,opt,name=model_identifier,json=modelIdentifier,proto3" json:"model_identifier,omitempty"`
	// OS version number, without the leading 'v'.
	// See the Device's os_type for the general OS category.
	// Example: "13.2.1".
	OsVersion string `protobuf:"bytes,3,opt,name=os_version,json=osVersion,proto3" json:"os_version,omitempty"`
	// OS build identifier. Augments the os_version.
	// Example: "22D68".
	OsBuild string `protobuf:"bytes,4,opt,name=os_build,json=osBuild,proto3" json:"os_build,omitempty"`
	// Known OS users (distinct from the Teleport user).
	OsUsernames []string `protobuf:"bytes,5,rep,name=os_usernames,json=osUsernames,proto3" json:"os_usernames,omitempty"`
	// Jamf binary version, without the leading 'v'.
	// Example: "9.27" or "10.44.1-t1677509507".
	JamfBinaryVersion string `protobuf:"bytes,6,opt,name=jamf_binary_version,json=jamfBinaryVersion,proto3" json:"jamf_binary_version,omitempty"`
	// External device identifier, for example the Jamf or Intune ID.
	ExternalId string `protobuf:"bytes,7,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
	// OS build supplemental number.
	// May match `sw_vers` BuildVersion more closely in certain situations, like
	// macOS rapid security response builds.
	// Example: "22F770820d".
	OsBuildSupplemental string `protobuf:"bytes,8,opt,name=os_build_supplemental,json=osBuildSupplemental,proto3" json:"os_build_supplemental,omitempty"`
	// OS identifier.
	// Mainly used to differentiate Linux distros, as there is be no variation
	// for systems like macOS or Windows.
	// Example: "ubuntu", "centos", "fedora", "rhel".
	OsId string `protobuf:"bytes,9,opt,name=os_id,json=osId,proto3" json:"os_id,omitempty"`
	// contains filtered or unexported fields
}

type DeviceSource struct {

	// Name of the source.
	// Matches the name of the corresponding MDM service, if applicable.
	// Readonly.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Origin of the source.
	// Readonly.
	Origin DeviceOrigin `protobuf:"varint,2,opt,name=origin,proto3,enum=teleport.devicetrust.v1.DeviceOrigin" json:"origin,omitempty"`
	// contains filtered or unexported fields
}

type DeviceTrustServiceClient interface {
	// CreateDevice creates a device, effectively registering it on Teleport.
	// Devices need to be registered before they can be enrolled.
	//
	// It is possible to create both a Device and a DeviceEnrollToken in a
	// single invocation, see CreateDeviceRequest.create_enroll_token.
	CreateDevice(ctx context.Context, in *CreateDeviceRequest, opts ...grpc.CallOption) (*Device, error)
	// UpdateDevice is a masked device update.
	//
	// Only certain fields may be updated, see Device for details.
	UpdateDevice(ctx context.Context, in *UpdateDeviceRequest, opts ...grpc.CallOption) (*Device, error)
	// UpsertDevice creates or updates a device.
	//
	// UpsertDevice attempts a write of all mutable fields on updates, therefore
	// reading a fresh copy of the device is recommended. Update semantics still
	// apply.
	UpsertDevice(ctx context.Context, in *UpsertDeviceRequest, opts ...grpc.CallOption) (*Device, error)
	// DeleteDevice hard-deletes a device, removing it and all collected data
	// history from the system.
	//
	// Prefer locking the device instead (see the `tctl lock` command). Deleting a
	// device doesn't invalidate existing device certificates, but does prevent
	// new device authentication ceremonies from occurring.
	//
	// Use with caution.
	DeleteDevice(ctx context.Context, in *DeleteDeviceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// FindDevices retrieves devices by device ID and/or asset tag.
	//
	// It provides an in-between search between fetching a device by ID and
	// listing all devices.
	//
	// ID matches are guaranteed to be present in the response.
	FindDevices(ctx context.Context, in *FindDevicesRequest, opts ...grpc.CallOption) (*FindDevicesResponse, error)
	// GetDevice retrieves a device by ID.
	GetDevice(ctx context.Context, in *GetDeviceRequest, opts ...grpc.CallOption) (*Device, error)
	// ListDevices lists all registered devices.
	ListDevices(ctx context.Context, in *ListDevicesRequest, opts ...grpc.CallOption) (*ListDevicesResponse, error)
	// BulkCreateDevices is a bulk variant of CreateDevice.
	//
	// Unlike CreateDevice, it does not support creation of enrollment tokens, as
	// it is meant for bulk inventory registration.
	BulkCreateDevices(ctx context.Context, in *BulkCreateDevicesRequest, opts ...grpc.CallOption) (*BulkCreateDevicesResponse, error)
	// CreateDeviceEnrollToken creates a DeviceEnrollToken for a Device.
	// An enrollment token is required for the enrollment ceremony. See
	// EnrollDevice.
	CreateDeviceEnrollToken(ctx context.Context, in *CreateDeviceEnrollTokenRequest, opts ...grpc.CallOption) (*DeviceEnrollToken, error)
	// EnrollDevice performs the device enrollment ceremony.
	//
	// Enrollment requires a previously-registered Device and a DeviceEnrollToken,
	// see CreateDevice and CreateDeviceEnrollToken.
	//
	// An enrolled device is allowed, via AuthenticateDevice, to acquire
	// certificates containing device extensions, thus gaining access to
	// device-aware actions.
	//
	// macOS enrollment flow:
	// -> EnrollDeviceInit (client)
	// <- MacOSEnrollChallenge (server)
	// -> MacOSEnrollChallengeResponse
	// <- EnrollDeviceSuccess
	//
	// TPM enrollment flow:
	// -> EnrollDeviceInit (client)
	// <- TPMEnrollChallenge (server)
	// -> TPMEnrollChallengeResponse
	// <- EnrollDeviceSuccess
	EnrollDevice(ctx context.Context, opts ...grpc.CallOption) (DeviceTrustService_EnrollDeviceClient, error)
	// AuthenticateDevice performs the device authentication ceremony.
	//
	// Device authentication exchanges existing user certificates without device
	// extensions for certificates augmented with device extensions. The new
	// certificates allow the user to perform device-aware actions.
	//
	// Only registered and enrolled devices may perform device authentication.
	AuthenticateDevice(ctx context.Context, opts ...grpc.CallOption) (DeviceTrustService_AuthenticateDeviceClient, error)
	// ConfirmDeviceWebAuthentication finalizes the device web authentication
	// ceremony started by the creation of a DeviceWebToken and subsequent
	// AuthenticateDevice call.
	//
	// The DeviceConfirmationToken issued by AuthenticateDevice is spent in this
	// method, which consequently augments the corresponding Web Session
	// certificates with device extensions.
	//
	// This method must be called by the Teleport Proxy, and the Proxy itself must
	// be called by the same browser that started the on-behalf-of authentication
	// attempt. See the /webapi/device/webconfirm endpoint.
	//
	// See
	// https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-authentication.
	ConfirmDeviceWebAuthentication(ctx context.Context, in *ConfirmDeviceWebAuthenticationRequest, opts ...grpc.CallOption) (*ConfirmDeviceWebAuthenticationResponse, error)
	// Syncs device inventory from a source exterior to Teleport, for example an
	// MDM.
	// Allows both partial and full syncs; for the latter, devices missing from
	// the external inventory are handled as specified.
	// Authorized either by a valid MDM service certificate or the appropriate
	// "device" permissions (create/update/delete).
	SyncInventory(ctx context.Context, opts ...grpc.CallOption) (DeviceTrustService_SyncInventoryClient, error)
	// Deprecated: Do not use.
	// Superseded by ResourceUsageService.GetUsage.
	GetDevicesUsage(ctx context.Context, in *GetDevicesUsageRequest, opts ...grpc.CallOption) (*DevicesUsage, error)
}

type DeviceTrustServiceServer interface {
	// CreateDevice creates a device, effectively registering it on Teleport.
	// Devices need to be registered before they can be enrolled.
	//
	// It is possible to create both a Device and a DeviceEnrollToken in a
	// single invocation, see CreateDeviceRequest.create_enroll_token.
	CreateDevice(context.Context, *CreateDeviceRequest) (*Device, error)
	// UpdateDevice is a masked device update.
	//
	// Only certain fields may be updated, see Device for details.
	UpdateDevice(context.Context, *UpdateDeviceRequest) (*Device, error)
	// UpsertDevice creates or updates a device.
	//
	// UpsertDevice attempts a write of all mutable fields on updates, therefore
	// reading a fresh copy of the device is recommended. Update semantics still
	// apply.
	UpsertDevice(context.Context, *UpsertDeviceRequest) (*Device, error)
	// DeleteDevice hard-deletes a device, removing it and all collected data
	// history from the system.
	//
	// Prefer locking the device instead (see the `tctl lock` command). Deleting a
	// device doesn't invalidate existing device certificates, but does prevent
	// new device authentication ceremonies from occurring.
	//
	// Use with caution.
	DeleteDevice(context.Context, *DeleteDeviceRequest) (*emptypb.Empty, error)
	// FindDevices retrieves devices by device ID and/or asset tag.
	//
	// It provides an in-between search between fetching a device by ID and
	// listing all devices.
	//
	// ID matches are guaranteed to be present in the response.
	FindDevices(context.Context, *FindDevicesRequest) (*FindDevicesResponse, error)
	// GetDevice retrieves a device by ID.
	GetDevice(context.Context, *GetDeviceRequest) (*Device, error)
	// ListDevices lists all registered devices.
	ListDevices(context.Context, *ListDevicesRequest) (*ListDevicesResponse, error)
	// BulkCreateDevices is a bulk variant of CreateDevice.
	//
	// Unlike CreateDevice, it does not support creation of enrollment tokens, as
	// it is meant for bulk inventory registration.
	BulkCreateDevices(context.Context, *BulkCreateDevicesRequest) (*BulkCreateDevicesResponse, error)
	// CreateDeviceEnrollToken creates a DeviceEnrollToken for a Device.
	// An enrollment token is required for the enrollment ceremony. See
	// EnrollDevice.
	CreateDeviceEnrollToken(context.Context, *CreateDeviceEnrollTokenRequest) (*DeviceEnrollToken, error)
	// EnrollDevice performs the device enrollment ceremony.
	//
	// Enrollment requires a previously-registered Device and a DeviceEnrollToken,
	// see CreateDevice and CreateDeviceEnrollToken.
	//
	// An enrolled device is allowed, via AuthenticateDevice, to acquire
	// certificates containing device extensions, thus gaining access to
	// device-aware actions.
	//
	// macOS enrollment flow:
	// -> EnrollDeviceInit (client)
	// <- MacOSEnrollChallenge (server)
	// -> MacOSEnrollChallengeResponse
	// <- EnrollDeviceSuccess
	//
	// TPM enrollment flow:
	// -> EnrollDeviceInit (client)
	// <- TPMEnrollChallenge (server)
	// -> TPMEnrollChallengeResponse
	// <- EnrollDeviceSuccess
	EnrollDevice(DeviceTrustService_EnrollDeviceServer) error
	// AuthenticateDevice performs the device authentication ceremony.
	//
	// Device authentication exchanges existing user certificates without device
	// extensions for certificates augmented with device extensions. The new
	// certificates allow the user to perform device-aware actions.
	//
	// Only registered and enrolled devices may perform device authentication.
	AuthenticateDevice(DeviceTrustService_AuthenticateDeviceServer) error
	// ConfirmDeviceWebAuthentication finalizes the device web authentication
	// ceremony started by the creation of a DeviceWebToken and subsequent
	// AuthenticateDevice call.
	//
	// The DeviceConfirmationToken issued by AuthenticateDevice is spent in this
	// method, which consequently augments the corresponding Web Session
	// certificates with device extensions.
	//
	// This method must be called by the Teleport Proxy, and the Proxy itself must
	// be called by the same browser that started the on-behalf-of authentication
	// attempt. See the /webapi/device/webconfirm endpoint.
	//
	// See
	// https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-authentication.
	ConfirmDeviceWebAuthentication(context.Context, *ConfirmDeviceWebAuthenticationRequest) (*ConfirmDeviceWebAuthenticationResponse, error)
	// Syncs device inventory from a source exterior to Teleport, for example an
	// MDM.
	// Allows both partial and full syncs; for the latter, devices missing from
	// the external inventory are handled as specified.
	// Authorized either by a valid MDM service certificate or the appropriate
	// "device" permissions (create/update/delete).
	SyncInventory(DeviceTrustService_SyncInventoryServer) error
	// Deprecated: Do not use.
	// Superseded by ResourceUsageService.GetUsage.
	GetDevicesUsage(context.Context, *GetDevicesUsageRequest) (*DevicesUsage, error)
	// contains filtered or unexported methods
}

type DeviceTrustService_AuthenticateDeviceClient interface {
	Send(*AuthenticateDeviceRequest) error
	Recv() (*AuthenticateDeviceResponse, error)
	grpc.ClientStream
}

type DeviceTrustService_AuthenticateDeviceServer interface {
	Send(*AuthenticateDeviceResponse) error
	Recv() (*AuthenticateDeviceRequest, error)
	grpc.ServerStream
}

type DeviceTrustService_EnrollDeviceClient interface {
	Send(*EnrollDeviceRequest) error
	Recv() (*EnrollDeviceResponse, error)
	grpc.ClientStream
}

type DeviceTrustService_EnrollDeviceServer interface {
	Send(*EnrollDeviceResponse) error
	Recv() (*EnrollDeviceRequest, error)
	grpc.ServerStream
}

type DeviceTrustService_SyncInventoryClient interface {
	Send(*SyncInventoryRequest) error
	Recv() (*SyncInventoryResponse, error)
	grpc.ClientStream
}

type DeviceTrustService_SyncInventoryServer interface {
	Send(*SyncInventoryResponse) error
	Recv() (*SyncInventoryRequest, error)
	grpc.ServerStream
}

type DeviceView int32

type DeviceWebToken struct {

	// Opaque token identifier.
	// Required for token usage.
	// System-generated.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Opaque device web token, in plaintext, encoded in base64.RawURLEncoding
	// (so it is inherently safe for URl use).
	// Required for token usage.
	// System-generated.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Identifier for the Web Session being device-authorized.
	// Required for creation.
	WebSessionId string `protobuf:"bytes,3,opt,name=web_session_id,json=webSessionId,proto3" json:"web_session_id,omitempty"`
	// Browser user agent, as acquired from the Web UI browser.
	// Used as part of expected device checks.
	// Required for creation.
	BrowserUserAgent string `protobuf:"bytes,4,opt,name=browser_user_agent,json=browserUserAgent,proto3" json:"browser_user_agent,omitempty"`
	// Browser public IP, as acquired from the Web UI browser.
	// Used as part of expected device checks.
	// Required for creation.
	BrowserIp string `protobuf:"bytes,5,opt,name=browser_ip,json=browserIp,proto3" json:"browser_ip,omitempty"`
	// Owner of the Web Session and trusted device.
	// Used internally by the Device Trust system.
	// Transient.
	User string `protobuf:"bytes,6,opt,name=user,proto3" json:"user,omitempty"`
	// ID of the devices allowed to perform on-behalf-of device authentication.
	// Used internally by the Device Trust system.
	// Transient.
	ExpectedDeviceIds []string `protobuf:"bytes,7,rep,name=expected_device_ids,json=expectedDeviceIds,proto3" json:"expected_device_ids,omitempty"`
	// contains filtered or unexported fields
}

type DevicesUsage struct {
	// contains filtered or unexported fields
}

type EnrollDeviceInit struct {

	// Device enrollment token.
	// See CreateDevice or CreateDeviceEnrollToken.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// ID of the device credential.
	CredentialId string `protobuf:"bytes,2,opt,name=credential_id,json=credentialId,proto3" json:"credential_id,omitempty"`
	// Device collected data.
	// Matched against the device registration information and any previously
	// collected data.
	DeviceData *DeviceCollectedData `protobuf:"bytes,3,opt,name=device_data,json=deviceData,proto3" json:"device_data,omitempty"`
	// Payload for macOS-specific data.
	Macos *MacOSEnrollPayload `protobuf:"bytes,4,opt,name=macos,proto3" json:"macos,omitempty"`
	// Payload for TPM-specific data. Used for Windows/Linux.
	Tpm *TPMEnrollPayload `protobuf:"bytes,5,opt,name=tpm,proto3" json:"tpm,omitempty"`
	// contains filtered or unexported fields
}

type EnrollDeviceRequest struct {

	// Types that are assignable to Payload:
	//
	//	*EnrollDeviceRequest_Init
	//	*EnrollDeviceRequest_MacosChallengeResponse
	//	*EnrollDeviceRequest_TpmChallengeResponse
	Payload isEnrollDeviceRequest_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type EnrollDeviceRequest_Init struct {
	Init *EnrollDeviceInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type EnrollDeviceRequest_MacosChallengeResponse struct {
	MacosChallengeResponse *MacOSEnrollChallengeResponse `protobuf:"bytes,2,opt,name=macos_challenge_response,json=macosChallengeResponse,proto3,oneof"`
}

type EnrollDeviceRequest_TpmChallengeResponse struct {
	TpmChallengeResponse *TPMEnrollChallengeResponse `protobuf:"bytes,3,opt,name=tpm_challenge_response,json=tpmChallengeResponse,proto3,oneof"`
}

type EnrollDeviceResponse struct {

	// Types that are assignable to Payload:
	//
	//	*EnrollDeviceResponse_Success
	//	*EnrollDeviceResponse_MacosChallenge
	//	*EnrollDeviceResponse_TpmChallenge
	Payload isEnrollDeviceResponse_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type EnrollDeviceResponse_MacosChallenge struct {
	MacosChallenge *MacOSEnrollChallenge `protobuf:"bytes,2,opt,name=macos_challenge,json=macosChallenge,proto3,oneof"`
}

type EnrollDeviceResponse_Success struct {
	Success *EnrollDeviceSuccess `protobuf:"bytes,1,opt,name=success,proto3,oneof"`
}

type EnrollDeviceResponse_TpmChallenge struct {
	TpmChallenge *TPMEnrollChallenge `protobuf:"bytes,3,opt,name=tpm_challenge,json=tpmChallenge,proto3,oneof"`
}

type EnrollDeviceSuccess struct {

	// The enrolled device.
	Device *Device `protobuf:"bytes,1,opt,name=device,proto3" json:"device,omitempty"`
	// contains filtered or unexported fields
}

type FindDevicesRequest struct {

	// Device ID or asset tag.
	IdOrTag string `protobuf:"bytes,1,opt,name=id_or_tag,json=idOrTag,proto3" json:"id_or_tag,omitempty"`
	// contains filtered or unexported fields
}

type FindDevicesResponse struct {

	// Devices that matched the search.
	// The number of resulting devices is expected to be low and may be
	// artificially capped by the server otherwise.
	Devices []*Device `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// contains filtered or unexported fields
}

type GetDeviceRequest struct {

	// ID of the device.
	DeviceId string `protobuf:"bytes,1,opt,name=device_id,json=deviceId,proto3" json:"device_id,omitempty"`
	// contains filtered or unexported fields
}

type GetDevicesUsageRequest struct {
	// contains filtered or unexported fields
}

type ListDevicesRequest struct {

	// The maximum number of items to return.
	// The server may impose a different page size at its discretion.
	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// The next_page_token value returned from a previous List request, if any.
	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Specifies which fields of the resource should be returned in the response.
	// Defaults to DEVICE_VIEW_LIST.
	View DeviceView `protobuf:"varint,3,opt,name=view,proto3,enum=teleport.devicetrust.v1.DeviceView" json:"view,omitempty"`
	// contains filtered or unexported fields
}

type ListDevicesResponse struct {

	// Devices that matched the search.
	Devices []*Device `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// Token to retrieve the next page of results, or empty if there are no
	// more results in the list.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type MacOSEnrollChallenge struct {

	// Randomly-generated, opaque challenge to be signed using the device key.
	Challenge []byte `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
	// contains filtered or unexported fields
}

type MacOSEnrollChallengeResponse struct {

	// Signature over the challenge, using the device key.
	Signature []byte `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

type MacOSEnrollPayload struct {

	// Device public key marshaled as a PKIX, ASN.1 DER.
	PublicKeyDer []byte `protobuf:"bytes,2,opt,name=public_key_der,json=publicKeyDer,proto3" json:"public_key_der,omitempty"`
	// contains filtered or unexported fields
}

type OSType int32

type SyncInventoryAck struct {
	// contains filtered or unexported fields
}

type SyncInventoryDevices struct {

	// Devices to sync.
	Devices []*Device `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// contains filtered or unexported fields
}

type SyncInventoryEnd struct {
	// contains filtered or unexported fields
}

type SyncInventoryMissingDevices struct {

	// Devices missing from the client-side sync.
	// Guaranteed to have the following fields: id, os_type, asset_tag and
	// profile.external_id.
	Devices []*Device `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// contains filtered or unexported fields
}

type SyncInventoryRequest struct {

	// Types that are assignable to Payload:
	//
	//	*SyncInventoryRequest_Start
	//	*SyncInventoryRequest_End
	//	*SyncInventoryRequest_DevicesToUpsert
	//	*SyncInventoryRequest_DevicesToRemove
	Payload isSyncInventoryRequest_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type SyncInventoryRequest_DevicesToRemove struct {
	DevicesToRemove *SyncInventoryDevices `protobuf:"bytes,4,opt,name=devices_to_remove,json=devicesToRemove,proto3,oneof"`
}

type SyncInventoryRequest_DevicesToUpsert struct {
	DevicesToUpsert *SyncInventoryDevices `protobuf:"bytes,3,opt,name=devices_to_upsert,json=devicesToUpsert,proto3,oneof"`
}

type SyncInventoryRequest_End struct {
	End *SyncInventoryEnd `protobuf:"bytes,2,opt,name=end,proto3,oneof"`
}

type SyncInventoryRequest_Start struct {
	Start *SyncInventoryStart `protobuf:"bytes,1,opt,name=start,proto3,oneof"`
}

type SyncInventoryResponse struct {

	// Types that are assignable to Payload:
	//
	//	*SyncInventoryResponse_Ack
	//	*SyncInventoryResponse_Result
	//	*SyncInventoryResponse_MissingDevices
	Payload isSyncInventoryResponse_Payload `protobuf_oneof:"payload"`
	// contains filtered or unexported fields
}

type SyncInventoryResponse_Ack struct {
	Ack *SyncInventoryAck `protobuf:"bytes,1,opt,name=ack,proto3,oneof"`
}

type SyncInventoryResponse_MissingDevices struct {
	MissingDevices *SyncInventoryMissingDevices `protobuf:"bytes,3,opt,name=missing_devices,json=missingDevices,proto3,oneof"`
}

type SyncInventoryResponse_Result struct {
	Result *SyncInventoryResult `protobuf:"bytes,2,opt,name=result,proto3,oneof"`
}

type SyncInventoryResult struct {

	// Devices modified, in the same order as the input when applicable.
	Devices []*DeviceOrStatus `protobuf:"bytes,1,rep,name=devices,proto3" json:"devices,omitempty"`
	// contains filtered or unexported fields
}

type SyncInventoryStart struct {

	// Source of the inventory sync.
	// Used for all devices. The `source` field in individual devices is ignored
	// by this RPC.
	Source *DeviceSource `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
	// If true, the server keeps track of the devices upserted during the sync.
	// After receiving the [SyncInventoryEnd] message, the server informs the
	// client of all devices that are present in storage but not observed in the
	// upserts.
	// See [SyncInventoryRequest] and [SyncInventoryMissingDevices] for details.
	TrackMissingDevices bool `protobuf:"varint,4,opt,name=track_missing_devices,json=trackMissingDevices,proto3" json:"track_missing_devices,omitempty"`
	// contains filtered or unexported fields
}

type TPMAttestationParameters struct {

	// The encoded TPMT_PUBLIC structure containing the attestation public key
	// and signing parameters.
	Public []byte `protobuf:"bytes,1,opt,name=public,proto3" json:"public,omitempty"`
	// The properties of the attestation key, encoded as a TPMS_CREATION_DATA
	// structure.
	CreateData []byte `protobuf:"bytes,2,opt,name=create_data,json=createData,proto3" json:"create_data,omitempty"`
	// An assertion as to the details of the key, encoded as a TPMS_ATTEST
	// structure.
	CreateAttestation []byte `protobuf:"bytes,3,opt,name=create_attestation,json=createAttestation,proto3" json:"create_attestation,omitempty"`
	// A signature of create_attestation, encoded as a TPMT_SIGNATURE structure.
	CreateSignature []byte `protobuf:"bytes,4,opt,name=create_signature,json=createSignature,proto3" json:"create_signature,omitempty"`
	// contains filtered or unexported fields
}

type TPMAuthenticateDeviceChallenge struct {

	// Randomly-generated nonce to be used during platform attestation by the
	// TPM.
	AttestationNonce []byte `protobuf:"bytes,1,opt,name=attestation_nonce,json=attestationNonce,proto3" json:"attestation_nonce,omitempty"`
	// contains filtered or unexported fields
}

type TPMAuthenticateDeviceChallengeResponse struct {

	// The result of the client's platform attestation with the nonce provided
	// in `TPMAuthenticateDeviceChallenge`.
	PlatformParameters *TPMPlatformParameters `protobuf:"bytes,1,opt,name=platform_parameters,json=platformParameters,proto3" json:"platform_parameters,omitempty"`
	// contains filtered or unexported fields
}

type TPMEncryptedCredential struct {

	// The `credential_blob` parameter to be used with the `ActivateCredential`
	// command. This is used with the decrypted value of `secret` in a
	// cryptographic process to decrypt the solution.
	CredentialBlob []byte `protobuf:"bytes,1,opt,name=credential_blob,json=credentialBlob,proto3" json:"credential_blob,omitempty"`
	// The `secret` parameter to be used with `ActivateCredential`. This is a
	// seed which can be decrypted with the EK. The decrypted seed is then used
	// when decrypting `credential_blob`.
	Secret []byte `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
	// contains filtered or unexported fields
}

type TPMEnrollChallenge struct {

	// The encrypted credential for the client to prove possession of the EK and
	// AK.
	EncryptedCredential *TPMEncryptedCredential `protobuf:"bytes,1,opt,name=encrypted_credential,json=encryptedCredential,proto3" json:"encrypted_credential,omitempty"`
	// The nonce to use when producing the quotes over the PCRs with the TPM
	// during the platform attestation.
	AttestationNonce []byte `protobuf:"bytes,2,opt,name=attestation_nonce,json=attestationNonce,proto3" json:"attestation_nonce,omitempty"`
	// contains filtered or unexported fields
}

type TPMEnrollChallengeResponse struct {

	// The client's solution to `TPMEncryptedCredential` included in
	// `TPMEnrollChallenge` using ActivateCredential.
	Solution []byte `protobuf:"bytes,1,opt,name=solution,proto3" json:"solution,omitempty"`
	// The result of the client's platform attestation with the nonce provided
	// in `TPMEnrollChallenge`.
	PlatformParameters *TPMPlatformParameters `protobuf:"bytes,2,opt,name=platform_parameters,json=platformParameters,proto3" json:"platform_parameters,omitempty"`
	// contains filtered or unexported fields
}