4.1.1 Administrator Accounts

The following tree diagram illustrates the NBI used for configuring “admin-accounts”.

  +--rw admin-accounts
     +--rw admin-account* [email-address]
        +--rw email-address                      string
        +--rw fullname?                          string
        +--rw password                           iana-crypt-hash:crypt-hash
        +--ro password-last-modified             ietf-yang-types:date-and-time
        +--rw access                             enumeration
        +---x resend-activation-email

Each account is keyed by an email address. Use of an email address enables mapping to subtenant mapping (for deployments running in product mode ‘x’, as email addresses are globally unique, and otherwise enables the email-based administrator account verification mechanism provided by SZTPD.

4.1.2 Audit Log

The following tree diagram illustrates the NBI used viewing audit logs (“ro” stands for “read-only”).

  +--ro audit-log
     +--ro log-entry*
        +--ro timestamp         ietf-yang-types:date-and-time
        +--ro source-ip         ietf-inet-types:ip-address
        +--ro source-proxies*   string
        +--ro host              string
        +--ro method            enumeration
        +--ro path              string
        +--ro outcome           enumeration
        +--ro comment?          string

4.1.3 Boot Images

The following tree diagram illustrates the NBI used for configuring boot-image records.

  +--rw boot-images {wn-sztpd-0:onboarding-supported}?
     +--rw boot-image* [name]
        +--rw name                          string
        +--rw os-name?                      string
        +--rw os-version?                   string
        +--rw download-uri*                 ietf-inet-types:uri
        +--rw image-verification* [hash-algorithm]
        |  +--rw hash-algorithm    identityref
        |  +--rw hash-value        ietf-yang-types:hex-string
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The boot-image records are used in constructing RFC 8572 based “onboarding information” responses.

4.1.4 Bootstrap Servers

The following tree diagram illustrates the NBI used for configuring “bootstrap-server” records.

  +--rw bootstrap-servers
     +--rw bootstrap-server* [name]
        +--rw name                          string
        +--rw address                       ietf-inet-types:host
        +--rw port?                         ietf-inet-types:port-number <443>
        +--rw trust-anchor?                 ietf-crypto-types:trust-anchor-cert-cms
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The bootstrap-server records are used in constructing RFC 8572 based “redirect information” responses.

4.1.5 Configurations

The following tree diagram illustrates the NBI used for configuring configuration records.

  +--rw configurations {wn-sztpd-0:onboarding-supported}?
     +--rw configuration* [name]
        +--rw name                          string
        +--rw configuration-handling?       enumeration
        +--rw config?                       binary
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The configuration records are used in constructing RFC 8572 based “onboarding information” responses.

4.1.6 Conveyed Information Responses

The following tree diagram illustrates the NBI used for configuring conveyed-information-responses records.

  +--rw conveyed-information-responses
     +--rw redirect-information-response* [name]
     |  +--rw name                          string
     |  +--rw redirect-information
     |  |  +--rw bootstrap-server*   -> ../../../../bootstrap-servers/bootstrap-server/name
     |  +--ro reference-statistics
     |     +--ro reference-count    uint32
     |     +--ro last-referenced    union
     +--rw onboarding-information-response* [name] {wn-sztpd-0:onboarding-supported}?
        +--rw name                          string
        +--rw onboarding-information
        |  +--rw boot-image                   -> ../../../../boot-images/boot-image/name
        |  +--rw pre-configuration-script?    -> ../../../../scripts/pre-configuration-script/name
        |  +--rw configuration?               -> ../../../../configurations/configuration/name
        |  +--rw post-configuration-script?   -> ../../../../scripts/post-configuration-script/name
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The conveyed-information-responses records are used in constructing RFC 8572 based “redirect” and “onboarding” information responses.

4.1.7 Device-Types

The “/device-types” tree enables configuration of device types to be recognized by the system.

Not only is being able to associate a device with a type helpful on its own, but each “device-type” entry enables more than just that, as explained below.

The device-types list contains an optional reference to the specific trust-anchor certificate in the Keystore used by the transport. This enables application specific verification that the device’s client certificate (i.e., its IDevID) exactly matches the expected certificate chain.

Similarly, the device-types list contains an optional “ownership-authorization” webhook enabling SZTPD to ensure that the specific tenant is the rightful owner of configured serial-numbers.

Important: In the “tenant” view, this entire data-tree is read-only. That is, all the “rw” would be shown as “ro” if this were the tenant view’s tree diagram. The /device-types tree is read-only in the “tenant” view because device types can only be set at the system level via the ‘native’ view.

The following tree diagram illustrates the NBI used for configuring device records.

======================================================= NOTE: '\' line wrapping per RFC 8792 =======================================================

  +--rw device-types
     +--rw device-type* [name]
        +--rw name                       string
        +--rw identity-certificates!
        |  +--rw verification
        |  |  +--rw local-truststore-reference {ietf-truststore:certificates}?
        |  |     +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
        |  |     +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certificate/name
        |  +--rw serial-number-extraction?   identityref <wn-x509-c2n:serial-number>
        +--rw ownership-authorization!
        |  +--rw https
        |     +--rw tcp-client-parameters
        |     |  +--rw remote-address    ietf-inet-types:host
        |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
        |     +--rw tls-client-parameters
        |     |  +--rw client-identity!
        |     |  |  +--rw (auth-type)
        |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
        |     |  |        +--rw certificate
        |     |  |           +--rw (local-or-keystore)
        |     |  +--rw server-authentication
        |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
        |     |     |  +--rw (local-or-truststore)
        |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
        |     |     |        +--rw local-truststore-reference {ietf-truststore:certificates}?
        |     |     |           +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
        |     |     |           +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
        |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
        |     |        +--rw (local-or-truststore)
        |     |           +--:(local-truststore) {ietf-truststore:certificates}?
        |     |              +--rw local-truststore-reference {ietf-truststore:certificates}?
        |     |                 +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
        |     |                 +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
        |     +--rw http-client-parameters
        |        +--rw client-identity!
        |           +--rw (auth-type)
        |              +--:(basic)
        |                 +--rw basic {ietf-http-client:basic-auth}?
        |                    +--rw user-id     string
        |                    +--rw password    string
        +--rw voucher-aquisition!
           +--rw https
              +--rw tcp-client-parameters
              |  +--rw remote-address    ietf-inet-types:host
              |  +--rw remote-port?      ietf-inet-types:port-number <443>
              +--rw tls-client-parameters
              |  +--rw client-identity!
              |  |  +--rw (auth-type)
              |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
              |  |        +--rw certificate
              |  |           +--rw (local-or-keystore)
              |  +--rw server-authentication
              |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
              |     |  +--rw (local-or-truststore)
              |     |     +--:(local-truststore) {ietf-truststore:certificates}?
              |     |        +--rw local-truststore-reference {ietf-truststore:certificates}?
              |     |           +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
              |     |           +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
              |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
              |        +--rw (local-or-truststore)
              |           +--:(local-truststore) {ietf-truststore:certificates}?
              |              +--rw local-truststore-reference {ietf-truststore:certificates}?
              |                 +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
              |                 +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
              +--rw http-client-parameters
                 +--rw client-identity!
                    +--rw (auth-type)
                       +--:(basic)
                          +--rw basic {ietf-http-client:basic-auth}?
                             +--rw user-id     string
                             +--rw password    string

4.1.8 Devices

The following tree diagram illustrates the NBI used for configuring device records.

======================================================= NOTE: '\' line wrapping per RFC 8792 =======================================================

  +--rw devices
     +--rw device* [serial-number]
        +--rw serial-number                    string
        +--rw activation-code?                 iana-crypt-hash:crypt-hash
        +--rw response-manager
        |  +--rw matched-response* [name]
        |     +--rw name              string
        |     +--rw match-criteria!
        |     |  +--rw match* [key]
        |     |     +--rw key           string
        |     |     +--rw not?          empty
        |     |     +--rw (test-type)
        |     |        +--:(present)
        |     |        |  +--rw present?   empty
        |     |        +--:(value)
        |     |        |  +--rw value?   string
        |     |        +--:(regex)
        |     |           +--rw regex?   string
        |     +--rw response
        |        +--rw reporting-level?     enumeration <minimal> {wn-sztpd-0:onboarding-supported}?
        |        +--rw (response-handler)
        |           +--:(none)
        |           |  +--rw none?   empty
        |           +--:(use-dynamic-callout)
        |           |  +--rw dynamic-callout
        |           |     +--rw reference?   -> ../../../../../../../dynamic-callouts/dynamic-callout/name
        |           +--:(managed-response)
        |              +--rw conveyed-information
        |                 +--rw (conveyed-information-handler)
        |                    +--:(use-dynamic-callout)
        |                    |  +--rw dynamic-callout
        |                    |     +--rw reference?   -> ../../../../../../../../dynamic-callouts/dynamic-callout/name
        |                    +--:(redirect-information)
        |                    |  +--rw redirect-information
        |                    |     +--rw (local-or-reference)
        |                    |        +--:(reference)
        |                    |           +--rw reference?   -> ../../../../../../../../conveyed-information-responses/redirect-information-response\
/name
        |                    +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |                       +--rw onboarding-information
        |                          +--rw (local-or-reference)
        |                             +--:(reference)
        |                                +--rw reference?   -> ../../../../../../../../conveyed-information-responses/onboarding-information-respon\
se/name
        +--ro bootstrapping-log
        |  +--ro log-entry*
        |     +--ro timestamp        ietf-yang-types:date-and-time
        |     +--ro source-ip        ietf-inet-types:ip-address
        |     +--ro method           string
        |     +--ro path             string
        |     +--ro return-code      uint16
        |     +--ro error-message?   string
        |     +--ro event-details
        |        +--ro (event-type)
        |           +--:(get-bootstrapping-data-event)
        |           |  +--ro get-bootstrapping-data-event
        |           |     +--ro passed-input
        |           |     |  +--ro (input-type)
        |           |     |     +--:(no-input-passed)
        |           |     |     |  +--ro no-input-passed?   empty
        |           |     |     +--:(input)
        |           |     |        +--ro input*
        |           |     |           +--ro key      string
        |           |     |           +--ro value    union
        |           |     +--ro selected-response?        union
        |           |     +--ro response-details
        |           |        +--ro (response-type)
        |           |           +--:(managed)
        |           |              +--ro managed-response-supplied
        |           |                 +--ro conveyed-information
        |           |                    +--ro (conveyed-information-handler)
        |           |                       +--:(dynamic-callout)
        |           |                       |  +--ro dynamic-callout-result
        |           |                       |     +--ro (result-type)?
        |           |                       |        +--:(no-callout-configured)
        |           |                       |        |  +--ro no-callout-configured?   empty
        |           |                       |        +--:(callout-configured)
        |           |                       |           +--ro name?             string
        |           |                       |           +--ro (callout-type)?
        |           |                       |              +--:(callback)
        |           |                       |              |  +--ro callback-results
        |           |                       |              |     +--ro (exit-status)
        |           |                       |              |        +--:(exited-successfully)
        |           |                       |              |        |  +--ro exited-successfully?   empty
        |           |                       |              |        +--:(exception-thrown)
        |           |                       |              |           +--ro exception-thrown?   empty
        |           |                       |              +--:(webhook) {wn-app:webhook-based-callouts}?
        |           |                       |                 +--ro webhook-results
        |           |                       |                    +--ro webhook*
        |           |                       |                       +--ro name             string
        |           |                       |                       +--ro uri              ietf-inet-types:uri
        |           |                       |                       +--ro (result-type)?
        |           |                       |                          +--:(connection-error)
        |           |                       |                          |  +--ro connection-error?   string
        |           |                       |                          +--:(http-status-code)
        |           |                       |                             +--ro http-status-code    string
        |           |                       +--:(redirect-information)
        |           |                       |  +--ro redirect-information
        |           |                       |     +--ro (local-or-reference)
        |           |                       |        +--:(reference)
        |           |                       |           +--ro referenced-definition?   string
        |           |                       +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |           |                          +--ro onboarding-information
        |           |                             +--ro (local-or-reference)
        |           |                                +--:(reference)
        |           |                                   +--ro referenced-definition?   string
        |           +--:(report-progress-event) {wn-sztpd-0:onboarding-supported}?
        |              +--ro report-progress-event
        |                 +--ro passed-input
        |                 |  +--ro progress-type         string
        |                 |  +--ro message?              string
        |                 |  +--ro ssh-host-keys?        anydata
        |                 |  +--ro trust-anchor-certs?   anydata
        |                 +--ro dynamic-callout-result
        |                    +--ro (result-type)?
        |                       +--:(no-callout-configured)
        |                       |  +--ro no-callout-configured?   empty
        |                       +--:(callout-configured)
        |                          +--ro name?             string
        |                          +--ro (callout-type)?
        |                             +--:(callback)
        |                             |  +--ro callback-results
        |                             |     +--ro (exit-status)
        |                             |        +--:(exited-successfully)
        |                             |        |  +--ro exited-successfully?   empty
        |                             |        +--:(exception-thrown)
        |                             |           +--ro exception-thrown?   empty
        |                             +--:(webhook) {wn-app:webhook-based-callouts}?
        |                                +--ro webhook-results
        |                                   +--ro webhook*
        |                                      +--ro name             string
        |                                      +--ro uri              ietf-inet-types:uri
        |                                      +--ro (result-type)?
        |                                         +--:(connection-error)
        |                                         |  +--ro connection-error?   string
        |                                         +--:(http-status-code)
        |                                            +--ro http-status-code    string
        +--ro lifecycle-statistics
        |  +--ro nbi-access-stats
        |  |  +--ro created               ietf-yang-types:date-and-time
        |  |  +--ro num-times-modified    uint16
        |  |  +--ro last-modified         ietf-yang-types:date-and-time
        |  +--ro sbi-access-stats
        |     +--ro num-times-accessed    uint16
        |     +--ro first-accessed        ietf-yang-types:date-and-time
        |     +--ro last-accessed         ietf-yang-types:date-and-time
        +--rw device-type                      -> /device-types/device-type/name

Device records are keyed by serial number, enabling device to tenant mapping, as serial numbers are globally unique.

Each device record includes the device’s lifecycle statistics (key north and south bound interactions) and bootstrapping log (a history of device-initiated interactions)

The device records are used in constructing RFC 8572 based “redirect” and “onboarding” information responses.

4.1.9 Dynamic Callouts

The following tree diagram illustrates the NBI used for configuring dynamic callouts, which may either be implemented via a call into a plugin or via a webhook¹.

======================================================= NOTE: '\' line wrapping per RFC 8792 =======================================================

  +--rw dynamic-callouts
     +--rw dynamic-callout* [name]
        +--rw name             string
        +--rw rpc-supported    identityref
        +--rw (callout-type)
           +--:(use-callback)
           |  +--rw callback
           |     +--rw plugin      -> /preferences/system/plugins/plugin/name
           |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functions/function/name
           +--:(use-webhooks) {wn-app:webhook-based-callouts}?
              +--rw webhooks
                 +--rw webhook* [name]
                 |  +--rw name          string
                 |  +--rw encoding?     enumeration <json>
                 |  +--rw (transport)
                 |     +--:(https) {ietf-restconf-client:https-initiate}?
                 |     |  +--rw https
                 |     |     +--rw tcp-client-parameters
                 |     |     |  +--rw remote-address    ietf-inet-types:host
                 |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
                 |     |     +--rw tls-client-parameters
                 |     |     |  +--rw client-identity!
                 |     |     |  |  +--rw (auth-type)
                 |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
                 |     |     |  |        +--rw certificate
                 |     |     |  |           +--rw (local-or-keystore)
                 |     |     |  |              +--:(local-keystore)
                 |     |     |  |                 +--rw local-keystore-reference
                 |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../../keystore/asymmetric-keys/asymmetric-k\
ey/name
                 |     |     |  |                    +--rw certificate       -> ../../../../../../../../../../keystore/asymmetric-keys/asymmetric-k\
ey[name = current()/../asymmetric-key]/certificates/certificate/name
                 |     |     |  +--rw server-authentication
                 |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
                 |     |     |     |  +--rw (local-or-truststore)
                 |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
                 |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/certifica\
te-bag/name
                 |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
                 |     |     |        +--rw (local-or-truststore)
                 |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
                 |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/certifica\
te-bag/name
                 |     |     +--rw http-client-parameters
                 |     |     |  +--rw client-identity!
                 |     |     |     +--rw (auth-type)
                 |     |     |        +--:(basic)
                 |     |     |           +--rw basic {ietf-http-client:basic-auth}?
                 |     |     |              +--rw user-id     string
                 |     |     |              +--rw password    string
                 |     |     +--rw restconf-client-parameters
                 |     +--:(http)
                 |        +--rw http
                 |           +--rw tcp-client-parameters
                 |           |  +--rw remote-address    ietf-inet-types:host
                 |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
                 |           +--rw http-client-parameters
                 |              +--rw client-identity!
                 |                 +--rw (auth-type)
                 |                    +--:(basic)
                 |                       +--rw basic {ietf-http-client:basic-auth}?
                 |                          +--rw user-id     string
                 |                          +--rw password    string
                 +--rw round-robin!
                    +--rw amount    uint16
                    +--rw units     enumeration

4.1.10 Keystore

The following tree diagram illustrates the NBI used for configuring keys held in the keystore.

  +--rw keystore
     +--rw asymmetric-keys
     |  +--rw asymmetric-key* [name]
     |     +--rw name                                   string
     |     +--rw public-key-format                      identityref
     |     +--rw public-key                             binary
     |     +--rw private-key-format?                    identityref
     |     +--rw (private-key-type)
     |     |  +--:(private-key)
     |     |  |  +--rw private-key?   binary
     |     |  +--:(hidden-private-key)
     |     |  |  +--rw hidden-private-key?   empty
     |     |  +--:(encrypted-private-key)
     |     |     +--rw encrypted-private-key
     |     |        +--rw (key-type)
     |     |        +--rw value?       binary
     |     +--rw certificates
     |     |  +--rw certificate* [name]
     |     |     +--rw name                          string
     |     |     +--rw cert                          ietf-crypto-types:end-entity-cert-cms
     |     |     +---n certificate-expiration
     |     |        +--ro expiration-date    ietf-yang-types:date-and-time
     |     |     +--ro reference-statistics
     |     |        +--ro reference-count    uint32
     |     |        +--ro last-referenced    union
     |     +---x generate-certificate-signing-request {ietf-crypto-types:certificate-signing-request-generation}?
     |     |  +--rw input
     |     |  |  +---w subject       binary
     |     |  |  +---w attributes?   binary
     |     |  +--rw output
     |     |     +--ro certificate-signing-request    ietf-crypto-types:csr
     |     +--ro reference-statistics
     |        +--ro reference-count    uint32
     |        +--ro last-referenced    union
     +--rw symmetric-keys
        +--rw symmetric-key* [name]
           +--rw name          string
           +--rw key-format?   identityref
           +--rw (key-type)
              +--:(key)
              |  +--rw key?   binary
              +--:(hidden-key)
              |  +--rw hidden-key?   empty
              +--:(encrypted-key)
                 +--rw encrypted-key
                    +--rw (key-type)
                    +--rw value?       binary

The keys held in the keystore are used in the transport configuration, e.g., to hold SZTPD’s private key used for each listening port] (see the Listening Ports and the APIs They Present in the Installation Guide).

4.1.11 Preferences

The following tree diagram illustrates the NBI used for configuring system and tenant-level preferences.

  +--rw preferences
     +--rw admin-accounts
     |  +--rw new-account-verification
     |  |  +--rw subject?   string <SZTPD new account verification required.>
     |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
     |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
     |  +--rw passwords
     |     +--rw strength-testing!
     |        +--rw min-length?   uint16 <16>
     +--rw notification-delivery!
     |  +--rw dynamic-callout
     |     +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
     +--rw system
        +--rw hostname?             ietf-inet-types:host
        +--rw email-from-address?   string <SZTPD Administrator <root@$SZTP-SERVER-ADDRESS>>
        +--rw features
        |  +--rw onboarding-supported?   boolean <true> {wn-sztpd-0:onboarding-supported}?
        +--rw plugins
           +--rw plugin* [name]
              +--rw name         string
              +--rw functions
                 +--rw function* [name]
                    +--rw name    string

4.1.12 Scripts

The following tree diagram illustrates the NBI used for configuring script records.

  +--rw scripts {wn-sztpd-0:onboarding-supported}?
     +--rw pre-configuration-script* [name]
     |  +--rw name                          string
     |  +--rw script?                       ietf-sztp-conveyed-info:script
     |  +--ro reference-statistics
     |     +--ro reference-count    uint32
     |     +--ro last-referenced    union
     +--rw post-configuration-script* [name]
        +--rw name                          string
        +--rw script?                       ietf-sztp-conveyed-info:script
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The script records are used in constructing RFC 8572 based “onboarding information” responses.

4.1.13 Tenants

For deployments using product mode ‘x’, the following tree diagram illustrates a snippet of the NBI used for configuring tenants.

  +--rw tenants
     +--rw tenant* [name]

Unlike all the other Northbound Interface sections, this section illustrates only the place in the hierarchy where the tenant containers are defined. Not shown are that each tenant container contains an instance of every other Northbound Interface section in it as well (with exception to the transport, which can only be configured by the host system.

4.1.14 Transport

The following tree diagram illustrates the NBI used for configuring transport records.

======================================================= NOTE: '\' line wrapping per RFC 8792 =======================================================

  +--rw transport
     +--rw listen! {ietf-restconf-server:http-listen or ietf-restconf-server:https-listen}?
        +--rw endpoint* [name]
           +--rw name          string
           +--rw (transport)
           |  +--:(http) {ietf-restconf-server:http-listen}?
           |  |  +--rw http
           |  |     +--rw external-endpoint!
           |  |     |  +--rw address    ietf-inet-types:ip-address
           |  |     |  +--rw port?      ietf-inet-types:port-number <443>
           |  |     +--rw tcp-server-parameters
           |  |     |  +--rw local-address    ietf-inet-types:ip-address
           |  |     |  +--rw local-port?      ietf-inet-types:port-number <80>
           |  |     +--rw http-server-parameters
           |  |     |  +--rw server-name?             string
           |  |     +--rw restconf-server-parameters
           |  |        +--rw client-identity-mappings
           |  |           +--rw cert-to-name* [id]
           |  |              +--rw id             uint32
           |  |              +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
           |  |              +--rw map-type       identityref
           |  |              +--rw name           string
           |  +--:(https) {ietf-restconf-server:https-listen}?
           |     +--rw https
           |        +--rw tcp-server-parameters
           |        |  +--rw local-address    ietf-inet-types:ip-address
           |        |  +--rw local-port?      ietf-inet-types:port-number <443>
           |        +--rw tls-server-parameters
           |        |  +--rw server-identity
           |        |  |  +--rw (auth-type)
           |        |  |     +--:(certificate) {ietf-tls-server:x509-certificate-auth}?
           |        |  |        +--rw certificate
           |        |  |           +--rw (local-or-keystore)
           |        |  |              +--:(local-keystore)
           |        |  |                 +--rw reference
           |        |  |                    +--rw asymmetric-key?   -> /keystore/asymmetric-keys/asymmetric-key/name
           |        |  |                    +--rw certificate?      -> /keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]\
/certificates/certificate/name
           |        |  +--rw client-authentication! {ietf-tls-server:client-auth-config-supported}?
           |        |     +--rw ca-certs! {ietf-tls-server:x509-certificate-auth}?
           |        |     |  +--rw (local-or-truststore)
           |        |     |     +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client-auth-config-supported}?
           |        |     |        +--rw local-truststore-reference?   -> /truststore/certificate-bags/certificate-bag/name
           |        |     +--rw ee-certs! {ietf-tls-server:x509-certificate-auth}?
           |        |        +--rw (local-or-truststore)
           |        |           +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client-auth-config-supported}?
           |        |              +--rw local-truststore-reference?   -> /truststore/certificate-bags/certificate-bag/name
           |        +--rw http-server-parameters
           |        |  +--rw server-name?             string
           |        +--rw restconf-server-parameters
           |           +--rw client-identity-mappings
           |              +--rw cert-to-name* [id]
           |                 +--rw id             uint32
           |                 +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
           |                 +--rw map-type       identityref
           |                 +--rw name           string
           +--rw use-for*      enumeration

Each device records includes the device’s bootstrapping log, a history of interactions with the device.

The transport configuration defines the listening ports SZTPD opens.

4.1.15 Truststore

The following tree diagram illustrates the NBI used for configuring trust-anchors held in the truststore.

  +--rw truststore
     +--rw certificate-bags! {ietf-truststore:certificates}?
        +--rw certificate-bag* [name]
           +--rw name                          string
           +--rw description?                  string
           +--rw certificate* [name]
           |  +--rw name                          string
           |  +--rw cert                          ietf-crypto-types:trust-anchor-cert-cms
           |  +---n certificate-expiration
           |     +--ro expiration-date    ietf-yang-types:date-and-time
           |  +--ro reference-statistics
           |     +--ro reference-count    uint32
           |     +--ro last-referenced    union
           +--ro reference-statistics
              +--ro reference-count    uint32
              +--ro last-referenced    union

The trust-anchors held in the truststore are use for many purposes (e.g., to authenticate clients, to authenticate remote systems, etc.).

4.2.1 Triggers

4.2.2 Tracking

Much of SZTPD’s reactive functionality depends on triggers.

4.2.3 Webhooks

SZTPD uses “webhooks” to send data to or request data from another system. A webhook is effectively an HTTP “POST” request. When sending data, the body of the POST request includes the data being sent. When receiving data, the body of the POST response contains the data being received.

4.3.1 Mode-1’s native view

The following tree diagram illustrates the entire NBI, from the perspective of the [Mode ‘1’] native interface.

======================================================= NOTE: '\' line wrapping per RFC 8792 =======================================================

module: wn-sztpd-1
  +--rw preferences
  |  +--rw admin-accounts
  |  |  +--rw new-account-verification
  |  |  |  +--rw subject?   string <SZTPD new account verification required.>
  |  |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
  |  |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
  |  |  +--rw passwords
  |  |     +--rw strength-testing!
  |  |        +--rw min-length?   uint16 <16>
  |  +--rw notification-delivery!
  |  |  +--rw dynamic-callout
  |  |     +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
  |  +--rw system
  |     +--rw hostname?             ietf-inet-types:host
  |     +--rw email-from-address?   string <SZTPD Administrator <root@$SZTP-SERVER-ADDRESS>>
  |     +--rw features
  |     |  +--rw onboarding-supported?   boolean <true> {wn-sztpd-0:onboarding-supported}?
  |     +--rw plugins
  |        +--rw plugin* [name]
  |           +--rw name         string
  |           +--rw functions
  |              +--rw function* [name]
  |                 +--rw name    string
  +--rw admin-accounts
  |  +--rw admin-account* [email-address]
  |     +--rw email-address                      string
  |     +--rw fullname?                          string
  |     +--rw password                           iana-crypt-hash:crypt-hash
  |     +--ro password-last-modified             ietf-yang-types:date-and-time
  |     +--rw access                             enumeration
  |     +---x resend-activation-email
  +--ro audit-log
  |  +--ro log-entry*
  |     +--ro timestamp         ietf-yang-types:date-and-time
  |     +--ro source-ip         ietf-inet-types:ip-address
  |     +--ro source-proxies*   string
  |     +--ro host              string
  |     +--ro method            enumeration
  |     +--ro path              string
  |     +--ro outcome           enumeration
  |     +--ro comment?          string
  +--rw truststore
  |  +--rw certificate-bags! {ietf-truststore:certificates}?
  |     +--rw certificate-bag* [name]
  |        +--rw name                          string
  |        +--rw description?                  string
  |        +--rw certificate* [name]
  |        |  +--rw name                          string
  |        |  +--rw cert                          ietf-crypto-types:trust-anchor-cert-cms
  |        |  +---n certificate-expiration
  |        |     +--ro expiration-date    ietf-yang-types:date-and-time
  |        |  +--ro reference-statistics
  |        |     +--ro reference-count    uint32
  |        |     +--ro last-referenced    union
  |        +--ro reference-statistics
  |           +--ro reference-count    uint32
  |           +--ro last-referenced    union
  +--rw keystore {not system-level-administration-disabled}?
  |  +--rw asymmetric-keys
  |  |  +--rw asymmetric-key* [name]
  |  |     +--rw name                                   string
  |  |     +--rw public-key-format                      identityref
  |  |     +--rw public-key                             binary
  |  |     +--rw private-key-format?                    identityref
  |  |     +--rw (private-key-type)
  |  |     |  +--:(private-key)
  |  |     |  |  +--rw private-key?   binary
  |  |     |  +--:(hidden-private-key)
  |  |     |  |  +--rw hidden-private-key?   empty
  |  |     |  +--:(encrypted-private-key)
  |  |     |     +--rw encrypted-private-key
  |  |     |        +--rw (key-type)
  |  |     |        +--rw value?       binary
  |  |     +--rw certificates
  |  |     |  +--rw certificate* [name]
  |  |     |     +--rw name                          string
  |  |     |     +--rw cert                          ietf-crypto-types:end-entity-cert-cms
  |  |     |     +---n certificate-expiration
  |  |     |        +--ro expiration-date    ietf-yang-types:date-and-time
  |  |     |     +--ro reference-statistics
  |  |     |        +--ro reference-count    uint32
  |  |     |        +--ro last-referenced    union
  |  |     +---x generate-certificate-signing-request {ietf-crypto-types:certificate-signing-request-generation}?
  |  |     |  +--rw input
  |  |     |  |  +---w subject       binary
  |  |     |  |  +---w attributes?   binary
  |  |     |  +--rw output
  |  |     |     +--ro certificate-signing-request    ietf-crypto-types:csr
  |  |     +--ro reference-statistics
  |  |        +--ro reference-count    uint32
  |  |        +--ro last-referenced    union
  |  +--rw symmetric-keys
  |     +--rw symmetric-key* [name]
  |        +--rw name          string
  |        +--rw key-format?   identityref
  |        +--rw (key-type)
  |           +--:(key)
  |           |  +--rw key?   binary
  |           +--:(hidden-key)
  |           |  +--rw hidden-key?   empty
  |           +--:(encrypted-key)
  |              +--rw encrypted-key
  |                 +--rw (key-type)
  |                 +--rw value?       binary
  +--rw dynamic-callouts
  |  +--rw dynamic-callout* [name]
  |     +--rw name             string
  |     +--rw rpc-supported    identityref
  |     +--rw (callout-type)
  |        +--:(use-callback)
  |        |  +--rw callback
  |        |     +--rw plugin      -> /preferences/system/plugins/plugin/name
  |        |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functions/function/name
  |        +--:(use-webhooks) {wn-app:webhook-based-callouts}?
  |           +--rw webhooks
  |              +--rw webhook* [name]
  |              |  +--rw name          string
  |              |  +--rw encoding?     enumeration <json>
  |              |  +--rw (transport)
  |              |     +--:(https) {ietf-restconf-client:https-initiate}?
  |              |     |  +--rw https
  |              |     |     +--rw tcp-client-parameters
  |              |     |     |  +--rw remote-address    ietf-inet-types:host
  |              |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |              |     |     +--rw tls-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |  |  +--rw (auth-type)
  |              |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |  |        +--rw certificate
  |              |     |     |  |           +--rw (local-or-keystore)
  |              |     |     |  |              +--:(local-keystore)
  |              |     |     |  |                 +--rw local-keystore-reference
  |              |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../../keystore/asymmetric-keys/asymmetric-k\
ey/name
  |              |     |     |  |                    +--rw certificate       -> ../../../../../../../../../../keystore/asymmetric-keys/asymmetric-k\
ey[name = current()/../asymmetric-key]/certificates/certificate/name
  |              |     |     |  +--rw server-authentication
  |              |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |     |  +--rw (local-or-truststore)
  |              |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/certifica\
te-bag/name
  |              |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |        +--rw (local-or-truststore)
  |              |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/certifica\
te-bag/name
  |              |     |     +--rw http-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |     +--rw (auth-type)
  |              |     |     |        +--:(basic)
  |              |     |     |           +--rw basic {ietf-http-client:basic-auth}?
  |              |     |     |              +--rw user-id     string
  |              |     |     |              +--rw password    string
  |              |     |     +--rw restconf-client-parameters
  |              |     +--:(http)
  |              |        +--rw http
  |              |           +--rw tcp-client-parameters
  |              |           |  +--rw remote-address    ietf-inet-types:host
  |              |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
  |              |           +--rw http-client-parameters
  |              |              +--rw client-identity!
  |              |                 +--rw (auth-type)
  |              |                    +--:(basic)
  |              |                       +--rw basic {ietf-http-client:basic-auth}?
  |              |                          +--rw user-id     string
  |              |                          +--rw password    string
  |              +--rw round-robin!
  |                 +--rw amount    uint16
  |                 +--rw units     enumeration
  +--rw transport {not system-level-administration-disabled}?
  |  +--rw listen! {ietf-restconf-server:http-listen or ietf-restconf-server:https-listen}?
  |     +--rw endpoint* [name]
  |        +--rw name          string
  |        +--rw (transport)
  |        |  +--:(http) {ietf-restconf-server:http-listen}?
  |        |  |  +--rw http
  |        |  |     +--rw external-endpoint!
  |        |  |     |  +--rw address    ietf-inet-types:ip-address
  |        |  |     |  +--rw port?      ietf-inet-types:port-number <443>
  |        |  |     +--rw tcp-server-parameters
  |        |  |     |  +--rw local-address    ietf-inet-types:ip-address
  |        |  |     |  +--rw local-port?      ietf-inet-types:port-number <80>
  |        |  |     +--rw http-server-parameters
  |        |  |     |  +--rw server-name?             string
  |        |  |     +--rw restconf-server-parameters
  |        |  |        +--rw client-identity-mappings
  |        |  |           +--rw cert-to-name* [id]
  |        |  |              +--rw id             uint32
  |        |  |              +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |  |              +--rw map-type       identityref
  |        |  |              +--rw name           string
  |        |  +--:(https) {ietf-restconf-server:https-listen}?
  |        |     +--rw https
  |        |        +--rw tcp-server-parameters
  |        |        |  +--rw local-address    ietf-inet-types:ip-address
  |        |        |  +--rw local-port?      ietf-inet-types:port-number <443>
  |        |        +--rw tls-server-parameters
  |        |        |  +--rw server-identity
  |        |        |  |  +--rw (auth-type)
  |        |        |  |     +--:(certificate) {ietf-tls-server:x509-certificate-auth}?
  |        |        |  |        +--rw certificate
  |        |        |  |           +--rw (local-or-keystore)
  |        |        |  |              +--:(local-keystore)
  |        |        |  |                 +--rw reference
  |        |        |  |                    +--rw asymmetric-key?   -> /keystore/asymmetric-keys/asymmetric-key/name
  |        |        |  |                    +--rw certificate?      -> /keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]\
/certificates/certificate/name
  |        |        |  +--rw client-authentication! {ietf-tls-server:client-auth-config-supported}?
  |        |        |     +--rw ca-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |     |  +--rw (local-or-truststore)
  |        |        |     |     +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client-auth-config-supported}?
  |        |        |     |        +--rw local-truststore-reference?   -> /truststore/certificate-bags/certificate-bag/name
  |        |        |     +--rw ee-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |        +--rw (local-or-truststore)
  |        |        |           +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client-auth-config-supported}?
  |        |        |              +--rw local-truststore-reference?   -> /truststore/certificate-bags/certificate-bag/name
  |        |        +--rw http-server-parameters
  |        |        |  +--rw server-name?             string
  |        |        +--rw restconf-server-parameters
  |        |           +--rw client-identity-mappings
  |        |              +--rw cert-to-name* [id]
  |        |                 +--rw id             uint32
  |        |                 +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |                 +--rw map-type       identityref
  |        |                 +--rw name           string
  |        +--rw use-for*      enumeration
  +--rw device-types
  |  +--rw device-type* [name]
  |     +--rw name                       string
  |     +--rw identity-certificates!
  |     |  +--rw verification
  |     |  |  +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |  |     +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |  |     +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certificate/name
  |     |  +--rw serial-number-extraction?   identityref <wn-x509-c2n:serial-number>
  |     +--rw ownership-authorization!
  |     |  +--rw https
  |     |     +--rw tcp-client-parameters
  |     |     |  +--rw remote-address    ietf-inet-types:host
  |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |     |     +--rw tls-client-parameters
  |     |     |  +--rw client-identity!
  |     |     |  |  +--rw (auth-type)
  |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |     |     |  |        +--rw certificate
  |     |     |  |           +--rw (local-or-keystore)
  |     |     |  +--rw server-authentication
  |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |     |     |     |  +--rw (local-or-truststore)
  |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |     |     |     |        +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |     |     |           +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |     |     |           +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |     |     |        +--rw (local-or-truststore)
  |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
  |     |     |              +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |     |                 +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |     |                 +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |     |     +--rw http-client-parameters
  |     |        +--rw client-identity!
  |     |           +--rw (auth-type)
  |     |              +--:(basic)
  |     |                 +--rw basic {ietf-http-client:basic-auth}?
  |     |                    +--rw user-id     string
  |     |                    +--rw password    string
  |     +--rw voucher-aquisition!
  |        +--rw https
  |           +--rw tcp-client-parameters
  |           |  +--rw remote-address    ietf-inet-types:host
  |           |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |           +--rw tls-client-parameters
  |           |  +--rw client-identity!
  |           |  |  +--rw (auth-type)
  |           |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |           |  |        +--rw certificate
  |           |  |           +--rw (local-or-keystore)
  |           |  +--rw server-authentication
  |           |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |           |     |  +--rw (local-or-truststore)
  |           |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |           |     |        +--rw local-truststore-reference {ietf-truststore:certificates}?
  |           |     |           +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |           |     |           +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |           |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |           |        +--rw (local-or-truststore)
  |           |           +--:(local-truststore) {ietf-truststore:certificates}?
  |           |              +--rw local-truststore-reference {ietf-truststore:certificates}?
  |           |                 +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |           |                 +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |           +--rw http-client-parameters
  |              +--rw client-identity!
  |                 +--rw (auth-type)
  |                    +--:(basic)
  |                       +--rw basic {ietf-http-client:basic-auth}?
  |                          +--rw user-id     string
  |                          +--rw password    string
  +--rw bootstrap-servers
  |  +--rw bootstrap-server* [name]
  |     +--rw name                          string
  |     +--rw address                       ietf-inet-types:host
  |     +--rw port?                         ietf-inet-types:port-number <443>
  |     +--rw trust-anchor?                 ietf-crypto-types:trust-anchor-cert-cms
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw boot-images {wn-sztpd-0:onboarding-supported}?
  |  +--rw boot-image* [name]
  |     +--rw name                          string
  |     +--rw os-name?                      string
  |     +--rw os-version?                   string
  |     +--rw download-uri*                 ietf-inet-types:uri
  |     +--rw image-verification* [hash-algorithm]
  |     |  +--rw hash-algorithm    identityref
  |     |  +--rw hash-value        ietf-yang-types:hex-string
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw scripts {wn-sztpd-0:onboarding-supported}?
  |  +--rw pre-configuration-script* [name]
  |  |  +--rw name                          string
  |  |  +--rw script?                       ietf-sztp-conveyed-info:script
  |  |  +--ro reference-statistics
  |  |     +--ro reference-count    uint32
  |  |     +--ro last-referenced    union
  |  +--rw post-configuration-script* [name]
  |     +--rw name                          string
  |     +--rw script?                       ietf-sztp-conveyed-info:script
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw configurations {wn-sztpd-0:onboarding-supported}?
  |  +--rw configuration* [name]
  |     +--rw name                          string
  |     +--rw configuration-handling?       enumeration
  |     +--rw config?                       binary
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw conveyed-information-responses
  |  +--rw redirect-information-response* [name]
  |  |  +--rw name                          string
  |  |  +--rw redirect-information
  |  |  |  +--rw bootstrap-server*   -> ../../../../bootstrap-servers/bootstrap-server/name
  |  |  +--ro reference-statistics
  |  |     +--ro reference-count    uint32
  |  |     +--ro last-referenced    union
  |  +--rw onboarding-information-response* [name] {wn-sztpd-0:onboarding-supported}?
  |     +--rw name                          string
  |     +--rw onboarding-information
  |     |  +--rw boot-image                   -> ../../../../boot-images/boot-image/name
  |     |  +--rw pre-configuration-script?    -> ../../../../scripts/pre-configuration-script/name
  |     |  +--rw configuration?               -> ../../../../configurations/configuration/name
  |     |  +--rw post-configuration-script?   -> ../../../../scripts/post-configuration-script/name
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw devices
     +--rw device* [serial-number]
        +--rw serial-number                    string
        +--rw activation-code?                 iana-crypt-hash:crypt-hash
        +--rw response-manager
        |  +--rw matched-response* [name]
        |     +--rw name              string
        |     +--rw match-criteria!
        |     |  +--rw match* [key]
        |     |     +--rw key           string
        |     |     +--rw not?          empty
        |     |     +--rw (test-type)
        |     |        +--:(present)
        |     |        |  +--rw present?   empty
        |     |        +--:(value)
        |     |        |  +--rw value?   string
        |     |        +--:(regex)
        |     |           +--rw regex?   string
        |     +--rw response
        |        +--rw reporting-level?     enumeration <minimal> {wn-sztpd-0:onboarding-supported}?
        |        +--rw (response-handler)
        |           +--:(none)
        |           |  +--rw none?   empty
        |           +--:(use-dynamic-callout)
        |           |  +--rw dynamic-callout
        |           |     +--rw reference?   -> ../../../../../../../dynamic-callouts/dynamic-callout/name
        |           +--:(managed-response)
        |              +--rw conveyed-information
        |                 +--rw (conveyed-information-handler)
        |                    +--:(use-dynamic-callout)
        |                    |  +--rw dynamic-callout
        |                    |     +--rw reference?   -> ../../../../../../../../dynamic-callouts/dynamic-callout/name
        |                    +--:(redirect-information)
        |                    |  +--rw redirect-information
        |                    |     +--rw (local-or-reference)
        |                    |        +--:(reference)
        |                    |           +--rw reference?   -> ../../../../../../../../conveyed-information-responses/redirect-information-response\
/name
        |                    +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |                       +--rw onboarding-information
        |                          +--rw (local-or-reference)
        |                             +--:(reference)
        |                                +--rw reference?   -> ../../../../../../../../conveyed-information-responses/onboarding-information-respon\
se/name
        +--ro bootstrapping-log
        |  +--ro log-entry*
        |     +--ro timestamp        ietf-yang-types:date-and-time
        |     +--ro source-ip        ietf-inet-types:ip-address
        |     +--ro method           string
        |     +--ro path             string
        |     +--ro return-code      uint16
        |     +--ro error-message?   string
        |     +--ro event-details
        |        +--ro (event-type)
        |           +--:(get-bootstrapping-data-event)
        |           |  +--ro get-bootstrapping-data-event
        |           |     +--ro passed-input
        |           |     |  +--ro (input-type)
        |           |     |     +--:(no-input-passed)
        |           |     |     |  +--ro no-input-passed?   empty
        |           |     |     +--:(input)
        |           |     |        +--ro input*
        |           |     |           +--ro key      string
        |           |     |           +--ro value    union
        |           |     +--ro selected-response?        union
        |           |     +--ro response-details
        |           |        +--ro (response-type)
        |           |           +--:(managed)
        |           |              +--ro managed-response-supplied
        |           |                 +--ro conveyed-information
        |           |                    +--ro (conveyed-information-handler)
        |           |                       +--:(dynamic-callout)
        |           |                       |  +--ro dynamic-callout-result
        |           |                       |     +--ro (result-type)?
        |           |                       |        +--:(no-callout-configured)
        |           |                       |        |  +--ro no-callout-configured?   empty
        |           |                       |        +--:(callout-configured)
        |           |                       |           +--ro name?             string
        |           |                       |           +--ro (callout-type)?
        |           |                       |              +--:(callback)
        |           |                       |              |  +--ro callback-results
        |           |                       |              |     +--ro (exit-status)
        |           |                       |              |        +--:(exited-successfully)
        |           |                       |              |        |  +--ro exited-successfully?   empty
        |           |                       |              |        +--:(exception-thrown)
        |           |                       |              |           +--ro exception-thrown?   empty
        |           |                       |              +--:(webhook) {wn-app:webhook-based-callouts}?
        |           |                       |                 +--ro webhook-results
        |           |                       |                    +--ro webhook*
        |           |                       |                       +--ro name             string
        |           |                       |                       +--ro uri              ietf-inet-types:uri
        |           |                       |                       +--ro (result-type)?
        |           |                       |                          +--:(connection-error)
        |           |                       |                          |  +--ro connection-error?   string
        |           |                       |                          +--:(http-status-code)
        |           |                       |                             +--ro http-status-code    string
        |           |                       +--:(redirect-information)
        |           |                       |  +--ro redirect-information
        |           |                       |     +--ro (local-or-reference)
        |           |                       |        +--:(reference)
        |           |                       |           +--ro referenced-definition?   string
        |           |                       +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |           |                          +--ro onboarding-information
        |           |                             +--ro (local-or-reference)
        |           |                                +--:(reference)
        |           |                                   +--ro referenced-definition?   string
        |           +--:(report-progress-event) {wn-sztpd-0:onboarding-supported}?
        |              +--ro report-progress-event
        |                 +--ro passed-input
        |                 |  +--ro progress-type         string
        |                 |  +--ro message?              string
        |                 |  +--ro ssh-host-keys?        anydata
        |                 |  +--ro trust-anchor-certs?   anydata
        |                 +--ro dynamic-callout-result
        |                    +--ro (result-type)?
        |                       +--:(no-callout-configured)
        |                       |  +--ro no-callout-configured?   empty
        |                       +--:(callout-configured)
        |                          +--ro name?             string
        |                          +--ro (callout-type)?
        |                             +--:(callback)
        |                             |  +--ro callback-results
        |                             |     +--ro (exit-status)
        |                             |        +--:(exited-successfully)
        |                             |        |  +--ro exited-successfully?   empty
        |                             |        +--:(exception-thrown)
        |                             |           +--ro exception-thrown?   empty
        |                             +--:(webhook) {wn-app:webhook-based-callouts}?
        |                                +--ro webhook-results
        |                                   +--ro webhook*
        |                                      +--ro name             string
        |                                      +--ro uri              ietf-inet-types:uri
        |                                      +--ro (result-type)?
        |                                         +--:(connection-error)
        |                                         |  +--ro connection-error?   string
        |                                         +--:(http-status-code)
        |                                            +--ro http-status-code    string
        +--ro lifecycle-statistics
        |  +--ro nbi-access-stats
        |  |  +--ro created               ietf-yang-types:date-and-time
        |  |  +--ro num-times-modified    uint16
        |  |  +--ro last-modified         ietf-yang-types:date-and-time
        |  +--ro sbi-access-stats
        |     +--ro num-times-accessed    uint16
        |     +--ro first-accessed        ietf-yang-types:date-and-time
        |     +--ro last-accessed         ietf-yang-types:date-and-time
        +--rw device-type                      -> /device-types/device-type/name

4.3.2 Mode-X’s native view

The following tree diagram illustrates the entire NBI, from the perspective of the Mode ‘x’ native interface (not the tenant interface.

======================================================= NOTE: '\' line wrapping per RFC 8792 =======================================================

module: wn-sztpd-x
  +--rw device-types
  |  +--rw device-type* [name]
  |     +--rw name                       string
  |     +--rw identity-certificates!
  |     |  +--rw verification
  |     |  |  +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |  |     +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |  |     +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certificate/name
  |     |  +--rw serial-number-extraction?   identityref <wn-x509-c2n:serial-number>
  |     +--rw ownership-authorization!
  |     |  +--rw https
  |     |     +--rw tcp-client-parameters
  |     |     |  +--rw remote-address    ietf-inet-types:host
  |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |     |     +--rw tls-client-parameters
  |     |     |  +--rw client-identity!
  |     |     |  |  +--rw (auth-type)
  |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |     |     |  |        +--rw certificate
  |     |     |  |           +--rw (local-or-keystore)
  |     |     |  +--rw server-authentication
  |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |     |     |     |  +--rw (local-or-truststore)
  |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |     |     |     |        +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |     |     |           +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |     |     |           +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |     |     |        +--rw (local-or-truststore)
  |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
  |     |     |              +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |     |                 +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |     |                 +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |     |     +--rw http-client-parameters
  |     |        +--rw client-identity!
  |     |           +--rw (auth-type)
  |     |              +--:(basic)
  |     |                 +--rw basic {ietf-http-client:basic-auth}?
  |     |                    +--rw user-id     string
  |     |                    +--rw password    string
  |     +--rw voucher-aquisition!
  |        +--rw https
  |           +--rw tcp-client-parameters
  |           |  +--rw remote-address    ietf-inet-types:host
  |           |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |           +--rw tls-client-parameters
  |           |  +--rw client-identity!
  |           |  |  +--rw (auth-type)
  |           |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |           |  |        +--rw certificate
  |           |  |           +--rw (local-or-keystore)
  |           |  +--rw server-authentication
  |           |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |           |     |  +--rw (local-or-truststore)
  |           |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |           |     |        +--rw local-truststore-reference {ietf-truststore:certificates}?
  |           |     |           +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |           |     |           +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |           |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |           |        +--rw (local-or-truststore)
  |           |           +--:(local-truststore) {ietf-truststore:certificates}?
  |           |              +--rw local-truststore-reference {ietf-truststore:certificates}?
  |           |                 +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |           |                 +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/../certificate-bag]/certi\
ficate/name
  |           +--rw http-client-parameters
  |              +--rw client-identity!
  |                 +--rw (auth-type)
  |                    +--:(basic)
  |                       +--rw basic {ietf-http-client:basic-auth}?
  |                          +--rw user-id     string
  |                          +--rw password    string
  +--rw preferences
  |  +--rw admin-accounts
  |  |  +--rw new-account-verification
  |  |  |  +--rw subject?   string <SZTPD new account verification required.>
  |  |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
  |  |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
  |  |  +--rw passwords
  |  |     +--rw strength-testing!
  |  |        +--rw min-length?   uint16 <16>
  |  +--rw notification-delivery!
  |  |  +--rw dynamic-callout
  |  |     +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
  |  +--rw system
  |     +--rw hostname?             ietf-inet-types:host
  |     +--rw email-from-address?   string <SZTPD Administrator <root@$SZTP-SERVER-ADDRESS>>
  |     +--rw features
  |     |  +--rw onboarding-supported?   boolean <true> {wn-sztpd-0:onboarding-supported}?
  |     +--rw plugins
  |        +--rw plugin* [name]
  |           +--rw name         string
  |           +--rw functions
  |              +--rw function* [name]
  |                 +--rw name    string
  +--rw admin-accounts
  |  +--rw admin-account* [email-address]
  |     +--rw email-address                      string
  |     +--rw fullname?                          string
  |     +--rw password                           iana-crypt-hash:crypt-hash
  |     +--ro password-last-modified             ietf-yang-types:date-and-time
  |     +--rw access                             enumeration
  |     +---x resend-activation-email
  +--ro audit-log
  |  +--ro log-entry*
  |     +--ro timestamp         ietf-yang-types:date-and-time
  |     +--ro source-ip         ietf-inet-types:ip-address
  |     +--ro source-proxies*   string
  |     +--ro host              string
  |     +--ro method            enumeration
  |     +--ro path              string
  |     +--ro outcome           enumeration
  |     +--ro comment?          string
  +--rw truststore
  |  +--rw certificate-bags! {ietf-truststore:certificates}?
  |     +--rw certificate-bag* [name]
  |        +--rw name                          string
  |        +--rw description?                  string
  |        +--rw certificate* [name]
  |        |  +--rw name                          string
  |        |  +--rw cert                          ietf-crypto-types:trust-anchor-cert-cms
  |        |  +---n certificate-expiration
  |        |     +--ro expiration-date    ietf-yang-types:date-and-time
  |        |  +--ro reference-statistics
  |        |     +--ro reference-count    uint32
  |        |     +--ro last-referenced    union
  |        +--ro reference-statistics
  |           +--ro reference-count    uint32
  |           +--ro last-referenced    union
  +--rw keystore
  |  +--rw asymmetric-keys
  |  |  +--rw asymmetric-key* [name]
  |  |     +--rw name                                   string
  |  |     +--rw public-key-format                      identityref
  |  |     +--rw public-key                             binary
  |  |     +--rw private-key-format?                    identityref
  |  |     +--rw (private-key-type)
  |  |     |  +--:(private-key)
  |  |     |  |  +--rw private-key?   binary
  |  |     |  +--:(hidden-private-key)
  |  |     |  |  +--rw hidden-private-key?   empty
  |  |     |  +--:(encrypted-private-key)
  |  |     |     +--rw encrypted-private-key
  |  |     |        +--rw (key-type)
  |  |     |        +--rw value?       binary
  |  |     +--rw certificates
  |  |     |  +--rw certificate* [name]
  |  |     |     +--rw name                          string
  |  |     |     +--rw cert                          ietf-crypto-types:end-entity-cert-cms
  |  |     |     +---n certificate-expiration
  |  |     |        +--ro expiration-date    ietf-yang-types:date-and-time
  |  |     |     +--ro reference-statistics
  |  |     |        +--ro reference-count    uint32
  |  |     |        +--ro last-referenced    union
  |  |     +---x generate-certificate-signing-request {ietf-crypto-types:certificate-signing-request-generation}?
  |  |     |  +--rw input
  |  |     |  |  +---w subject       binary
  |  |     |  |  +---w attributes?   binary
  |  |     |  +--rw output
  |  |     |     +--ro certificate-signing-request    ietf-crypto-types:csr
  |  |     +--ro reference-statistics
  |  |        +--ro reference-count    uint32
  |  |        +--ro last-referenced    union
  |  +--rw symmetric-keys
  |     +--rw symmetric-key* [name]
  |        +--rw name          string
  |        +--rw key-format?   identityref
  |        +--rw (key-type)
  |           +--:(key)
  |           |  +--rw key?   binary
  |           +--:(hidden-key)
  |           |  +--rw hidden-key?   empty
  |           +--:(encrypted-key)
  |              +--rw encrypted-key
  |                 +--rw (key-type)
  |                 +--rw value?       binary
  +--rw dynamic-callouts
  |  +--rw dynamic-callout* [name]
  |     +--rw name             string
  |     +--rw rpc-supported    identityref
  |     +--rw (callout-type)
  |        +--:(use-callback)
  |        |  +--rw callback
  |        |     +--rw plugin      -> /preferences/system/plugins/plugin/name
  |        |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functions/function/name
  |        +--:(use-webhooks) {wn-app:webhook-based-callouts}?
  |           +--rw webhooks
  |              +--rw webhook* [name]
  |              |  +--rw name          string
  |              |  +--rw encoding?     enumeration <json>
  |              |  +--rw (transport)
  |              |     +--:(https) {ietf-restconf-client:https-initiate}?
  |              |     |  +--rw https
  |              |     |     +--rw tcp-client-parameters
  |              |     |     |  +--rw remote-address    ietf-inet-types:host
  |              |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |              |     |     +--rw tls-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |  |  +--rw (auth-type)
  |              |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |  |        +--rw certificate
  |              |     |     |  |           +--rw (local-or-keystore)
  |              |     |     |  |              +--:(local-keystore)
  |              |     |     |  |                 +--rw local-keystore-reference
  |              |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../../keystore/asymmetric-keys/asymmetric-k\
ey/name
  |              |     |     |  |                    +--rw certificate       -> ../../../../../../../../../../keystore/asymmetric-keys/asymmetric-k\
ey[name = current()/../asymmetric-key]/certificates/certificate/name
  |              |     |     |  +--rw server-authentication
  |              |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |     |  +--rw (local-or-truststore)
  |              |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/certifica\
te-bag/name
  |              |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |        +--rw (local-or-truststore)
  |              |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/certifica\
te-bag/name
  |              |     |     +--rw http-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |     +--rw (auth-type)
  |              |     |     |        +--:(basic)
  |              |     |     |           +--rw basic {ietf-http-client:basic-auth}?
  |              |     |     |              +--rw user-id     string
  |              |     |     |              +--rw password    string
  |              |     |     +--rw restconf-client-parameters
  |              |     +--:(http)
  |              |        +--rw http
  |              |           +--rw tcp-client-parameters
  |              |           |  +--rw remote-address    ietf-inet-types:host
  |              |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
  |              |           +--rw http-client-parameters
  |              |              +--rw client-identity!
  |              |                 +--rw (auth-type)
  |              |                    +--:(basic)
  |              |                       +--rw basic {ietf-http-client:basic-auth}?
  |              |                          +--rw user-id     string
  |              |                          +--rw password    string
  |              +--rw round-robin!
  |                 +--rw amount    uint16
  |                 +--rw units     enumeration
  +--rw transport
  |  +--rw listen! {ietf-restconf-server:http-listen or ietf-restconf-server:https-listen}?
  |     +--rw endpoint* [name]
  |        +--rw name          string
  |        +--rw (transport)
  |        |  +--:(http) {ietf-restconf-server:http-listen}?
  |        |  |  +--rw http
  |        |  |     +--rw external-endpoint!
  |        |  |     |  +--rw address    ietf-inet-types:ip-address
  |        |  |     |  +--rw port?      ietf-inet-types:port-number <443>
  |        |  |     +--rw tcp-server-parameters
  |        |  |     |  +--rw local-address    ietf-inet-types:ip-address
  |        |  |     |  +--rw local-port?      ietf-inet-types:port-number <80>
  |        |  |     +--rw http-server-parameters
  |        |  |     |  +--rw server-name?             string
  |        |  |     +--rw restconf-server-parameters
  |        |  |        +--rw client-identity-mappings
  |        |  |           +--rw cert-to-name* [id]
  |        |  |              +--rw id             uint32
  |        |  |              +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |  |              +--rw map-type       identityref
  |        |  |              +--rw name           string
  |        |  +--:(https) {ietf-restconf-server:https-listen}?
  |        |     +--rw https
  |        |        +--rw tcp-server-parameters
  |        |        |  +--rw local-address    ietf-inet-types:ip-address
  |        |        |  +--rw local-port?      ietf-inet-types:port-number <443>
  |        |        +--rw tls-server-parameters
  |        |        |  +--rw server-identity
  |        |        |  |  +--rw (auth-type)
  |        |        |  |     +--:(certificate) {ietf-tls-server:x509-certificate-auth}?
  |        |        |  |        +--rw certificate
  |        |        |  |           +--rw (local-or-keystore)
  |        |        |  |              +--:(local-keystore)
  |        |        |  |                 +--rw reference
  |        |        |  |                    +--rw asymmetric-key?   -> /keystore/asymmetric-keys/asymmetric-key/name
  |        |        |  |                    +--rw certificate?      -> /keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]\
/certificates/certificate/name
  |        |        |  +--rw client-authentication! {ietf-tls-server:client-auth-config-supported}?
  |        |        |     +--rw ca-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |     |  +--rw (local-or-truststore)
  |        |        |     |     +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client-auth-config-supported}?
  |        |        |     |        +--rw local-truststore-reference?   -> /truststore/certificate-bags/certificate-bag/name
  |        |        |     +--rw ee-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |        +--rw (local-or-truststore)
  |        |        |           +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client-auth-config-supported}?
  |        |        |              +--rw local-truststore-reference?   -> /truststore/certificate-bags/certificate-bag/name
  |        |        +--rw http-server-parameters
  |        |        |  +--rw server-name?             string
  |        |        +--rw restconf-server-parameters
  |        |           +--rw client-identity-mappings
  |        |              +--rw cert-to-name* [id]
  |        |                 +--rw id             uint32
  |        |                 +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |                 +--rw map-type       identityref
  |        |                 +--rw name           string
  |        +--rw use-for*      enumeration
  +--rw tenants
     +--rw tenant* [name]
        +--rw name                              string
        +--rw preferences
        |  +--rw admin-accounts
        |  |  +--rw new-account-verification
        |  |  |  +--rw subject?   string <SZTPD new account verification required.>
        |  |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
        |  |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
        |  |  +--rw passwords
        |  |     +--rw strength-testing!
        |  |        +--rw min-length?   uint16 <16>
        |  +--rw notification-delivery!
        |     +--rw dynamic-callout
        |        +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
        +--rw admin-accounts
        |  +--rw admin-account* [email-address]
        |     +--rw email-address                      string
        |     +--rw fullname?                          string
        |     +--rw password                           iana-crypt-hash:crypt-hash
        |     +--ro password-last-modified             ietf-yang-types:date-and-time
        |     +--rw access                             enumeration
        |     +---x resend-activation-email
        +--ro audit-log
        |  +--ro log-entry*
        |     +--ro timestamp         ietf-yang-types:date-and-time
        |     +--ro source-ip         ietf-inet-types:ip-address
        |     +--ro source-proxies*   string
        |     +--ro host              string
        |     +--ro method            enumeration
        |     +--ro path              string
        |     +--ro outcome           enumeration
        |     +--ro comment?          string
        +--rw truststore
        |  +--rw certificate-bags! {ietf-truststore:certificates}?
        |     +--rw certificate-bag* [name]
        |        +--rw name                          string
        |        +--rw description?                  string
        |        +--rw certificate* [name]
        |        |  +--rw name                          string
        |        |  +--rw cert                          ietf-crypto-types:trust-anchor-cert-cms
        |        |  +---n certificate-expiration
        |        |     +--ro expiration-date    ietf-yang-types:date-and-time
        |        |  +--ro reference-statistics
        |        |     +--ro reference-count    uint32
        |        |     +--ro last-referenced    union
        |        +--ro reference-statistics
        |           +--ro reference-count    uint32
        |           +--ro last-referenced    union
        +--rw keystore
        |  +--rw asymmetric-keys
        |  |  +--rw asymmetric-key* [name]
        |  |     +--rw name                                   string
        |  |     +--rw public-key-format                      identityref
        |  |     +--rw public-key                             binary
        |  |     +--rw private-key-format?                    identityref
        |  |     +--rw (private-key-type)
        |  |     |  +--:(private-key)
        |  |     |  |  +--rw private-key?   binary
        |  |     |  +--:(hidden-private-key)
        |  |     |  |  +--rw hidden-private-key?   empty
        |  |     |  +--:(encrypted-private-key)
        |  |     |     +--rw encrypted-private-key
        |  |     |        +--rw (key-type)
        |  |     |        +--rw value?       binary
        |  |     +--rw certificates
        |  |     |  +--rw certificate* [name]
        |  |     |     +--rw name                          string
        |  |     |     +--rw cert                          ietf-crypto-types:end-entity-cert-cms
        |  |     |     +---n certificate-expiration
        |  |     |        +--ro expiration-date    ietf-yang-types:date-and-time
        |  |     |     +--ro reference-statistics
        |  |     |        +--ro reference-count    uint32
        |  |     |        +--ro last-referenced    union
        |  |     +---x generate-certificate-signing-request {ietf-crypto-types:certificate-signing-request-generation}?
        |  |     |  +--rw input
        |  |     |  |  +---w subject       binary
        |  |     |  |  +---w attributes?   binary
        |  |     |  +--rw output
        |  |     |     +--ro certificate-signing-request    ietf-crypto-types:csr
        |  |     +--ro reference-statistics
        |  |        +--ro reference-count    uint32
        |  |        +--ro last-referenced    union
        |  +--rw symmetric-keys
        |     +--rw symmetric-key* [name]
        |        +--rw name          string
        |        +--rw key-format?   identityref
        |        +--rw (key-type)
        |           +--:(key)
        |           |  +--rw key?   binary
        |           +--:(hidden-key)
        |           |  +--rw hidden-key?   empty
        |           +--:(encrypted-key)
        |              +--rw encrypted-key
        |                 +--rw (key-type)
        |                 +--rw value?       binary
        +--rw dynamic-callouts
        |  +--rw dynamic-callout* [name]
        |     +--rw name             string
        |     +--rw rpc-supported    identityref
        |     +--rw (callout-type)
        |        +--:(use-callback)
        |        |  +--rw callback
        |        |     +--rw plugin      -> /preferences/system/plugins/plugin/name
        |        |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functions/function/name
        |        +--:(use-webhooks) {wn-app:webhook-based-callouts}?
        |           +--rw webhooks
        |              +--rw webhook* [name]
        |              |  +--rw name          string
        |              |  +--rw encoding?     enumeration <json>
        |              |  +--rw (transport)
        |              |     +--:(https) {ietf-restconf-client:https-initiate}?
        |              |     |  +--rw https
        |              |     |     +--rw tcp-client-parameters
        |              |     |     |  +--rw remote-address    ietf-inet-types:host
        |              |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
        |              |     |     +--rw tls-client-parameters
        |              |     |     |  +--rw client-identity!
        |              |     |     |  |  +--rw (auth-type)
        |              |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
        |              |     |     |  |        +--rw certificate
        |              |     |     |  |           +--rw (local-or-keystore)
        |              |     |     |  |              +--:(local-keystore)
        |              |     |     |  |                 +--rw local-keystore-reference
        |              |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../../keystore/asymmetric-keys/asymme\
tric-key/name
        |              |     |     |  |                    +--rw certificate       -> ../../../../../../../../../../keystore/asymmetric-keys/asymme\
tric-key[name = current()/../asymmetric-key]/certificates/certificate/name
        |              |     |     |  +--rw server-authentication
        |              |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
        |              |     |     |     |  +--rw (local-or-truststore)
        |              |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
        |              |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/cer\
tificate-bag/name
        |              |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
        |              |     |     |        +--rw (local-or-truststore)
        |              |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
        |              |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../../truststore/certificate-bags/cer\
tificate-bag/name
        |              |     |     +--rw http-client-parameters
        |              |     |     |  +--rw client-identity!
        |              |     |     |     +--rw (auth-type)
        |              |     |     |        +--:(basic)
        |              |     |     |           +--rw basic {ietf-http-client:basic-auth}?
        |              |     |     |              +--rw user-id     string
        |              |     |     |              +--rw password    string
        |              |     |     +--rw restconf-client-parameters
        |              |     +--:(http)
        |              |        +--rw http
        |              |           +--rw tcp-client-parameters
        |              |           |  +--rw remote-address    ietf-inet-types:host
        |              |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
        |              |           +--rw http-client-parameters
        |              |              +--rw client-identity!
        |              |                 +--rw (auth-type)
        |              |                    +--:(basic)
        |              |                       +--rw basic {ietf-http-client:basic-auth}?
        |              |                          +--rw user-id     string
        |              |                          +--rw password    string
        |              +--rw round-robin!
        |                 +--rw amount    uint16
        |                 +--rw units     enumeration
        +--rw bootstrap-servers
        |  +--rw bootstrap-server* [name]
        |     +--rw name                          string
        |     +--rw address                       ietf-inet-types:host
        |     +--rw port?                         ietf-inet-types:port-number <443>
        |     +--rw trust-anchor?                 ietf-crypto-types:trust-anchor-cert-cms
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw boot-images {wn-sztpd-0:onboarding-supported}?
        |  +--rw boot-image* [name]
        |     +--rw name                          string
        |     +--rw os-name?                      string
        |     +--rw os-version?                   string
        |     +--rw download-uri*                 ietf-inet-types:uri
        |     +--rw image-verification* [hash-algorithm]
        |     |  +--rw hash-algorithm    identityref
        |     |  +--rw hash-value        ietf-yang-types:hex-string
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw scripts {wn-sztpd-0:onboarding-supported}?
        |  +--rw pre-configuration-script* [name]
        |  |  +--rw name                          string
        |  |  +--rw script?                       ietf-sztp-conveyed-info:script
        |  |  +--ro reference-statistics
        |  |     +--ro reference-count    uint32
        |  |     +--ro last-referenced    union
        |  +--rw post-configuration-script* [name]
        |     +--rw name                          string
        |     +--rw script?                       ietf-sztp-conveyed-info:script
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw configurations {wn-sztpd-0:onboarding-supported}?
        |  +--rw configuration* [name]
        |     +--rw name                          string
        |     +--rw configuration-handling?       enumeration
        |     +--rw config?                       binary
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw conveyed-information-responses
        |  +--rw redirect-information-response* [name]
        |  |  +--rw name                          string
        |  |  +--rw redirect-information
        |  |  |  +--rw bootstrap-server*   -> ../../../../bootstrap-servers/bootstrap-server/name
        |  |  +--ro reference-statistics
        |  |     +--ro reference-count    uint32
        |  |     +--ro last-referenced    union
        |  +--rw onboarding-information-response* [name] {wn-sztpd-0:onboarding-supported}?
        |     +--rw name                          string
        |     +--rw onboarding-information
        |     |  +--rw boot-image                   -> ../../../../boot-images/boot-image/name
        |     |  +--rw pre-configuration-script?    -> ../../../../scripts/pre-configuration-script/name
        |     |  +--rw configuration?               -> ../../../../configurations/configuration/name
        |     |  +--rw post-configuration-script?   -> ../../../../scripts/post-configuration-script/name
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw devices
           +--rw device* [serial-number]
              +--rw serial-number                    string
              +--rw activation-code?                 iana-crypt-hash:crypt-hash
              +--rw response-manager
              |  +--rw matched-response* [name]
              |     +--rw name              string
              |     +--rw match-criteria!
              |     |  +--rw match* [key]
              |     |     +--rw key           string
              |     |     +--rw not?          empty
              |     |     +--rw (test-type)
              |     |        +--:(present)
              |     |        |  +--rw present?   empty
              |     |        +--:(value)
              |     |        |  +--rw value?   string
              |     |        +--:(regex)
              |     |           +--rw regex?   string
              |     +--rw response
              |        +--rw reporting-level?     enumeration <minimal> {wn-sztpd-0:onboarding-supported}?
              |        +--rw (response-handler)
              |           +--:(none)
              |           |  +--rw none?   empty
              |           +--:(use-dynamic-callout)
              |           |  +--rw dynamic-callout
              |           |     +--rw reference?   -> ../../../../../../../dynamic-callouts/dynamic-callout/name
              |           +--:(managed-response)
              |              +--rw conveyed-information
              |                 +--rw (conveyed-information-handler)
              |                    +--:(use-dynamic-callout)
              |                    |  +--rw dynamic-callout
              |                    |     +--rw reference?   -> ../../../../../../../../dynamic-callouts/dynamic-callout/name
              |                    +--:(redirect-information)
              |                    |  +--rw redirect-information
              |                    |     +--rw (local-or-reference)
              |                    |        +--:(reference)
              |                    |           +--rw reference?   -> ../../../../../../../../conveyed-information-responses/redirect-information-re\
sponse/name
              |                    +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
              |                       +--rw onboarding-information
              |                          +--rw (local-or-reference)
              |                             +--:(reference)
              |                                +--rw reference?   -> ../../../../../../../../conveyed-information-responses/onboarding-information-\
response/name
              +--ro bootstrapping-log
              |  +--ro log-entry*
              |     +--ro timestamp        ietf-yang-types:date-and-time
              |     +--ro source-ip        ietf-inet-types:ip-address
              |     +--ro method           string
              |     +--ro path             string
              |     +--ro return-code      uint16
              |     +--ro error-message?   string
              |     +--ro event-details
              |        +--ro (event-type)
              |           +--:(get-bootstrapping-data-event)
              |           |  +--ro get-bootstrapping-data-event
              |           |     +--ro passed-input
              |           |     |  +--ro (input-type)
              |           |     |     +--:(no-input-passed)
              |           |     |     |  +--ro no-input-passed?   empty
              |           |     |     +--:(input)
              |           |     |        +--ro input*
              |           |     |           +--ro key      string
              |           |     |           +--ro value    union
              |           |     +--ro selected-response?        union
              |           |     +--ro response-details
              |           |        +--ro (response-type)
              |           |           +--:(managed)
              |           |              +--ro managed-response-supplied
              |           |                 +--ro conveyed-information
              |           |                    +--ro (conveyed-information-handler)
              |           |                       +--:(dynamic-callout)
              |           |                       |  +--ro dynamic-callout-result
              |           |                       |     +--ro (result-type)?
              |           |                       |        +--:(no-callout-configured)
              |           |                       |        |  +--ro no-callout-configured?   empty
              |           |                       |        +--:(callout-configured)
              |           |                       |           +--ro name?             string
              |           |                       |           +--ro (callout-type)?
              |           |                       |              +--:(callback)
              |           |                       |              |  +--ro callback-results
              |           |                       |              |     +--ro (exit-status)
              |           |                       |              |        +--:(exited-successfully)
              |           |                       |              |        |  +--ro exited-successfully?   empty
              |           |                       |              |        +--:(exception-thrown)
              |           |                       |              |           +--ro exception-thrown?   empty
              |           |                       |              +--:(webhook) {wn-app:webhook-based-callouts}?
              |           |                       |                 +--ro webhook-results
              |           |                       |                    +--ro webhook*
              |           |                       |                       +--ro name             string
              |           |                       |                       +--ro uri              ietf-inet-types:uri
              |           |                       |                       +--ro (result-type)?
              |           |                       |                          +--:(connection-error)
              |           |                       |                          |  +--ro connection-error?   string
              |           |                       |                          +--:(http-status-code)
              |           |                       |                             +--ro http-status-code    string
              |           |                       +--:(redirect-information)
              |           |                       |  +--ro redirect-information
              |           |                       |     +--ro (local-or-reference)
              |           |                       |        +--:(reference)
              |           |                       |           +--ro referenced-definition?   string
              |           |                       +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
              |           |                          +--ro onboarding-information
              |           |                             +--ro (local-or-reference)
              |           |                                +--:(reference)
              |           |                                   +--ro referenced-definition?   string
              |           +--:(report-progress-event) {wn-sztpd-0:onboarding-supported}?
              |              +--ro report-progress-event
              |                 +--ro passed-input
              |                 |  +--ro progress-type         string
              |                 |  +--ro message?              string
              |                 |  +--ro ssh-host-keys?        anydata
              |                 |  +--ro trust-anchor-certs?   anydata
              |                 +--ro dynamic-callout-result
              |                    +--ro (result-type)?
              |                       +--:(no-callout-configured)
              |                       |  +--ro no-callout-configured?   empty
              |                       +--:(callout-configured)
              |                          +--ro name?             string
              |                          +--ro (callout-type)?
              |                             +--:(callback)
              |                             |  +--ro callback-results
              |                             |     +--ro (exit-status)
              |                             |        +--:(exited-successfully)
              |                             |        |  +--ro exited-successfully?   empty
              |                             |        +--:(exception-thrown)
              |                             |           +--ro exception-thrown?   empty
              |                             +--:(webhook) {wn-app:webhook-based-callouts}?
              |                                +--ro webhook-results
              |                                   +--ro webhook*
              |                                      +--ro name             string
              |                                      +--ro uri              ietf-inet-types:uri
              |                                      +--ro (result-type)?
              |                                         +--:(connection-error)
              |                                         |  +--ro connection-error?   string
              |                                         +--:(http-status-code)
              |                                            +--ro http-status-code    string
              +--ro lifecycle-statistics
              |  +--ro nbi-access-stats
              |  |  +--ro created               ietf-yang-types:date-and-time
              |  |  +--ro num-times-modified    uint16
              |  |  +--ro last-modified         ietf-yang-types:date-and-time
              |  +--ro sbi-access-stats
              |     +--ro num-times-accessed    uint16
              |     +--ro first-accessed        ietf-yang-types:date-and-time
              |     +--ro last-accessed         ietf-yang-types:date-and-time
              +--rw device-type                      -> /device-types/device-type/name