4.2.1 Example: POST-ing an entry after another entry

Assuming a device’s “response-manager” contains the ordered list of “matched-response” entries: “resp1”, “resp2”, and “resp3”, then the command:

$ cat matched-response.json
{
  "wn-sztpd-1:matched-response": [
    {
      'name': 'new',
      'response': {
        'none': [None]
      }
    }
  ]
}

$ curl -i -X POST --data @matched-response.json -H "Content-Type:application/yang-data+json" \
http://127.0.0.1:8080/restconf/ds/ietf-datastores:running/wn-sztpd-1:devices/device=my-serial\
-number/response-manager?insert=after&point=/wn-sztpd-1:devices/device=my-serial-number/respo\
nse-manager/matched-response=resp1

would result in the list of entries: “resp1”, “new”, “resp2”, and “resp3”.

4.2.2 Example: PUT-ing an entry before another entry

Assuming a redirect-information-response contains the ordered list of “bootstrap-server” entries: “bs1”, “bs2”, and “bs3”, then the command:

$ cat bootstrap-server.json
{
  "wn-sztpd-1:bootstrap-server": [
    "bs-3"
  ]
}

$ curl -i -X PUT --data @bootstrap-server.json -H "Content-Type:application/yang-data+json" \
http://127.0.0.1:8080/restconf/ds/ietf-datastores:running/wn-sztpd-1:conveyed-information-re\
sponses/redirect-information-response=my-redirect-information/redirect-information/bootstrap\
-server=bs3?insert=before&point=/wn-sztpd-1:conveyed-information-responses/redirect-informat\
ion-response=my-redirect-information/redirect-information/bootstrap-server=bs2

would result in the list of entries: “bs1”, “bs3”, and “bs2”.

4.3.1 Example: POST-ing an entry after another

Assuming the configured “download-uri” leaf-list contains values as follows:

{
  "wn-sztpd-1:download-uri" : [
    https://cdn1.example.com/path/to/image/file,
    https://cdn2.example.com/path/to/image/file,
    https://cdn3.example.com/path/to/image/file
  ]
}

then the command:

$ cat download-uri.json
{
  "wn-sztpd-1:download-uri": [
    https://new4.example.com/path/to/image/file
  ]
}

$ curl -i -X POST --data @download-uri.json -H "Content-Type:application/yang-data+json" \
http://127.0.0.1:8080/restconf/ds/ietf-datastores:running/wn-sztpd-1:boot-images/boot-ima\
ge=vendoros-19.2r1b6.img?insert=after&point=/wn-sztpd-1:boot-images/boot-image=vendoros-1\
9.2r1b6.img/download-uri=https%3A%2F%2Fcdn1.example.com%2Fpath%2Fto%2Fimage%2Ffile

would result in the list of entries:

{
  "wn-sztpd-1:download-uri" : [
    https://cdn1.example.com/path/to/image/file,
    https://new4.example.com/path/to/image/file,
    https://cdn2.example.com/path/to/image/file,
    https://cdn3.example.com/path/to/image/file
  ]
}

4.3.2 Example: PUT-ing an entry after another entry

Assuming the configured “download-uri” leaf-list contains values as follows:

{
  "wn-sztpd-1:download-uri" : [
    https://cdn1.example.com/path/to/image/file,
    https://new4.example.com/path/to/image/file,
    https://cdn2.example.com/path/to/image/file,
    https://cdn3.example.com/path/to/image/file
  ]
}

then the command:

$ cat download-uri.json
{
  "wn-sztpd-1:download-uri": [
    https://new4.example.com/path/to/image/file
  ]
}

$ curl -i -X POST --data @download-uri.json -H "Content-Type:application/yang-data+json" \
http://127.0.0.1:8080/restconf/ds/ietf-datastores:running/wn-sztpd-1:boot-images/boot-ima\
ge=vendoros-19.2r1b6.img/download-uri=https%3A%2F%2Fnew4.example.com%2Fpath%2Fto%2Fimage%\
2Ffile?insert=before&point=/wn-sztpd-1:boot-images/boot-image=vendoros-19.2r1b6.img/downl\
oad-uri=https%3A%2F%2Fcdn3.example.com%2Fpath%2Fto%2Fimage%2Ffile

would result in the list of entries:

{
  "wn-sztpd-1:download-uri" : [
    https://cdn1.example.com/path/to/image/file,
    https://cdn2.example.com/path/to/image/file,
    https://new4.example.com/path/to/image/file,
    https://cdn3.example.com/path/to/image/file
  ]
}

4.4.1 The “limit” Query Parameter

• The “limit” query parameter limits the number of entries from the working result set (i.e., after the “offset” parameter has been applied) that are returned.
• The allowed values are positive integers.
• This parameter is only allowed for the GET and HEAD methods on “list” and “leaf-list” data resources. A “400 Bad Request” status-line is returned if used for other methods or on other resource types.
• If this query parameter is not present, the number of entries that may be returned is unbounded.
• This query parameter MUST be supported for all lists and leaf-lists.

4.4.2 The “offset” Query Parameter

• The “offset” query parameter indicates the number of entries in the working result set (i.e., after the “direction” parameter has been applied) that should be skipped.
• The allowed values are positive integers. If the skip value exceeds the number of entries in the working result set, then “416 Range Not Satisfiable” status-line is returned.
• This parameter is only allowed for the GET and HEAD methods on
• This parameter is only allowed for the GET and HEAD methods on “list” and “leaf-list” data resources. A “400 Bad Request” status-line is returned if used for other methods or on other resource types.
• If this query parameter is not present, the default value is to not skip over any values from the working result set.
• This query parameter MUST be supported for all lists and leaf-lists.

4.4.3 The “direction” Query Parameter

• The “direction” query parameter indicates how the entries in the working result set should be traversed.
• The allowed values are:
  • forwards
    • Return entries in the “forward” direction. Also known as the “default” or “ascending” direction.
  • backwards
    • Return entries in the “backward” direction. Also known as the “reversed” or “descending” direction.
• This parameter is only allowed for the GET and HEAD methods on “list” and “leaf-list” data resources. A “400 Bad Request” status-line is returned if used for other methods or on other resource types.
• If this query parameter is not present, the default value is “forwards”.
• This query parameter MUST be supported for all lists and leaf-lists.

5.1.1 Administrator Accounts

The following tree diagram illustrates the NBI used for configuring “admin-accounts”.

  +--rw admin-accounts
     +--rw admin-account* [email-address]
        +--rw email-address                      string
        +--rw fullname?                          string
        +--rw password                           iana-crypt-hash:crypt-hash
        +--ro password-last-modified             ietf-yang-types:date-and-time
        +--rw access                             enumeration
        +---x resend-activation-email

Each account is keyed by an email address. Use of an email address enables mapping to subtenant mapping (for deployments running in product mode ‘x’, as email addresses are globally unique, and otherwise enables the email-based administrator account verification mechanism provided by SZTPD.

5.1.2 Audit Log

The following tree diagram illustrates the NBI used viewing audit logs (“ro” stands for “read-only”).

  +--ro audit-log
     +--ro log-entry*
        +--ro timestamp         ietf-yang-types:date-and-time
        +--ro source-ip         ietf-inet-types:ip-address
        +--ro source-proxies*   string
        +--ro host              string
        +--ro method            enumeration
        +--ro path              string
        +--ro outcome           enumeration
        +--ro comment?          string

5.1.3 Boot Images

The following tree diagram illustrates the NBI used for configuring boot-image records.

  +--rw boot-images {wn-sztpd-0:onboarding-supported}?
     +--rw boot-image* [name]
        +--rw name                          string
        +--rw os-name?                      string
        +--rw os-version?                   string
        +--rw download-uri*                 ietf-inet-types:uri
        +--rw image-verification* [hash-algorithm]
        |  +--rw hash-algorithm    identityref
        |  +--rw hash-value        ietf-yang-types:hex-string
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The boot-image records are used in constructing RFC 8572 based “onboarding information” responses.

5.1.4 Bootstrap Servers

The following tree diagram illustrates the NBI used for configuring “bootstrap-server” records.

  +--rw bootstrap-servers
     +--rw bootstrap-server* [name]
        +--rw name                          string
        +--rw address                       ietf-inet-types:host
        +--rw port?                         ietf-inet-types:port-number <443>
        +--rw trust-anchor?                 ietf-crypto-types:trust-anchor-cert-cms
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The bootstrap-server records are used in constructing RFC 8572 based “redirect information” responses.

5.1.5 Configurations

The following tree diagram illustrates the NBI used for configuring configuration records.

  +--rw configurations {wn-sztpd-0:onboarding-supported}?
     +--rw configuration* [name]
        +--rw name                          string
        +--rw configuration-handling?       enumeration
        +--rw config?                       binary
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The configuration records are used in constructing RFC 8572 based “onboarding information” responses.

5.1.6 Conveyed Information Responses

The following tree diagram illustrates the NBI used for configuring conveyed-information-responses records.

  +--rw conveyed-information-responses
     +--rw redirect-information-response* [name]
     |  +--rw name                          string
     |  +--rw redirect-information
     |  |  +--rw bootstrap-server*   -> ../../../../bootstrap-servers/bootstrap-server/name
     |  +--ro reference-statistics
     |     +--ro reference-count    uint32
     |     +--ro last-referenced    union
     +--rw onboarding-information-response* [name] {wn-sztpd-0:onboarding-supported}?
        +--rw name                          string
        +--rw onboarding-information
        |  +--rw boot-image                   -> ../../../../boot-images/boot-image/name
        |  +--rw pre-configuration-script?    -> ../../../../scripts/pre-configuration-script/name
        |  +--rw configuration?               -> ../../../../configurations/configuration/name
        |  +--rw post-configuration-script?   -> ../../../../scripts/post-configuration-script/name
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The conveyed-information-responses records are used in constructing RFC 8572 based “redirect” and “onboarding” information responses.

5.1.7 Device-Types

The “/device-types” tree enables configuration of device types to be recognized by the system.

Not only is being able to associate a device with a type helpful on its own, but each “device-type” entry enables more than just that, as explained below.

The device-types list contains an optional reference to the specific trust-anchor certificate in the Keystore used by the transport. This enables application specific verification that the device’s client certificate (i.e., its IDevID) exactly matches the expected certificate chain.

Similarly, the device-types list contains an optional “ownership-authorization” webhook enabling SZTPD to ensure that the specific tenant is the rightful owner of configured serial-numbers.

Important: In the “tenant” view, this entire data-tree is read-only. That is, all the “rw” would be shown as “ro” if this were the tenant view’s tree diagram. The /device-types tree is read-only in the “tenant” view because device types can only be set at the system level via the ‘native’ view.

The following tree diagram illustrates the NBI used for configuring device records.

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

  +--rw device-types
     +--rw device-type* [name]
        +--rw name                       string
        +--rw identity-certificates!
        |  +--rw verification
        |  |  +--rw local-truststore-reference {ietf-truststore:certificates}?
        |  |     +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
        |  |     +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/\
../certificate-bag]/certificate/name
        |  +--rw serial-number-extraction?   identityref <wn-x509-c2n:serial-number>
        +--rw ownership-authorization!
        |  +--rw dynamic-callout
        |     +--rw reference?   -> /dynamic-callouts/dynamic-callout/name
        +--rw voucher-aquisition!
           +--rw dynamic-callout
              +--rw reference?   -> /dynamic-callouts/dynamic-callout/name

5.1.8 Devices

The following tree diagram illustrates the NBI used for configuring device records.

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

  +--rw devices
     +--rw device* [serial-number]
        +--rw serial-number                    string
        +--rw activation-code?                 iana-crypt-hash:crypt-hash
        +--rw response-manager
        |  +--rw matched-response* [name]
        |     +--rw name              string
        |     +--rw match-criteria!
        |     |  +--rw match* [key]
        |     |     +--rw key           string
        |     |     +--rw not?          empty
        |     |     +--rw (test-type)
        |     |        +--:(present)
        |     |        |  +--rw present?   empty
        |     |        +--:(value)
        |     |        |  +--rw value?   string
        |     |        +--:(regex)
        |     |           +--rw regex?   string
        |     +--rw response
        |        +--rw reporting-level?     enumeration <minimal> {wn-sztpd-0:onboarding-supported}?
        |        +--rw (response-handler)
        |           +--:(none)
        |           |  +--rw none?   empty
        |           +--:(managed-response)
        |              +--rw conveyed-information
        |                 +--rw (conveyed-information-handler)
        |                    +--:(use-dynamic-callout)
        |                    |  +--rw dynamic-callout
        |                    |     +--rw reference?   -> ../../../../../../../../dynamic-callouts/dynamic-c\
allout/name
        |                    +--:(redirect-information)
        |                    |  +--rw redirect-information
        |                    |     +--rw (local-or-reference)
        |                    |        +--:(reference)
        |                    |           +--rw reference?   -> ../../../../../../../../conveyed-information\
-responses/redirect-information-response/name
        |                    +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |                       +--rw onboarding-information
        |                          +--rw (local-or-reference)
        |                             +--:(reference)
        |                                +--rw reference?   -> ../../../../../../../../conveyed-information\
-responses/onboarding-information-response/name
        +---n progress-report-received
           +--ro progress-report?   anydata
        +--ro bootstrapping-log
        |  +--ro log-entry*
        |     +--ro timestamp         ietf-yang-types:date-and-time
        |     +--ro source-ip         ietf-inet-types:ip-address
        |     +--ro method            string
        |     +--ro path              string
        |     +--ro return-code       uint16
        |     +--ro error-returned?   anydata
        |     +--ro event-details
        |        +--ro (event-type)
        |           +--:(get-bootstrapping-data-event)
        |           |  +--ro get-bootstrapping-data-event
        |           |     +--ro passed-input
        |           |     |  +--ro (input-type)
        |           |     |     +--:(no-input-passed)
        |           |     |     |  +--ro no-input-passed?   empty
        |           |     |     +--:(input)
        |           |     |        +--ro input*
        |           |     |           +--ro key      string
        |           |     |           +--ro value    anydata
        |           |     +--ro selected-response?        union
        |           |     +--ro response-details
        |           |        +--ro (response-type)
        |           |           +--:(managed-response)
        |           |              +--ro managed-response
        |           |                 +--ro conveyed-information
        |           |                    +--ro (conveyed-information-handler)
        |           |                       +--:(dynamic-callout)
        |           |                       |  +--ro dynamic-callout
        |           |                       |     +--ro (result-type)?
        |           |                       |        +--:(no-callout-configured)
        |           |                       |        |  +--ro no-callout-configured?   empty
        |           |                       |        +--:(callout-configured)
        |           |                       |           +--ro name                     string
        |           |                       |           +--ro rpc-supported            identityref
        |           |                       |           +--ro callout-type             enumeration
        |           |                       |           +--ro (callback-or-webhook)?
        |           |                       |              +--:(callback)
        |           |                       |              |  +--ro callback-details
        |           |                       |              |  |  +--ro plugin      string
        |           |                       |              |  |  +--ro function    string
        |           |                       |              |  +--ro callback-results
        |           |                       |              |     +--ro (exit-status)
        |           |                       |              |        +--:(exception-thrown)
        |           |                       |              |        |  +--ro exception-thrown?   string
        |           |                       |              |        +--:(exited-normally)
        |           |                       |              |           +--ro exited-normally?   string
        |           |                       |              +--:(webhook) {wn-app:webhook-based-callouts}?
        |           |                       |                 +--ro webhook-details
        |           |                       |                 |  +--ro num-webhooks-configured    uint8
        |           |                       |                 +--ro webhook-results
        |           |                       |                    +--ro webhook*
        |           |                       |                       +--ro name             string
        |           |                       |                       +--ro uri              ietf-inet-types:\
uri
        |           |                       |                       +--ro (result-type)?
        |           |                       |                          +--:(connection-error)
        |           |                       |                          |  +--ro connection-error?   string
        |           |                       |                          +--:(http-status-code)
        |           |                       |                             +--ro http-status-code    string
        |           |                       +--:(redirect-information)
        |           |                       |  +--ro redirect-information
        |           |                       |     +--ro (local-or-reference)
        |           |                       |        +--:(reference)
        |           |                       |           +--ro referenced-definition?   string
        |           |                       +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |           |                          +--ro onboarding-information
        |           |                             +--ro (local-or-reference)
        |           |                                +--:(reference)
        |           |                                   +--ro referenced-definition?   string
        |           +--:(report-progress-event) {wn-sztpd-0:onboarding-supported}?
        |              +--ro report-progress-event
        |                 +--ro passed-input
        |                 |  +--ro progress-type         string
        |                 |  +--ro message?              string
        |                 |  +--ro ssh-host-keys?        anydata
        |                 |  +--ro trust-anchor-certs?   anydata
        |                 +--ro dynamic-callout
        |                    +--ro (result-type)?
        |                       +--:(no-callout-configured)
        |                       |  +--ro no-callout-configured?   empty
        |                       +--:(callout-configured)
        |                          +--ro name                     string
        |                          +--ro rpc-supported            identityref
        |                          +--ro callout-type             enumeration
        |                          +--ro (callback-or-webhook)?
        |                             +--:(callback)
        |                             |  +--ro callback-details
        |                             |  |  +--ro plugin      string
        |                             |  |  +--ro function    string
        |                             |  +--ro callback-results
        |                             |     +--ro (exit-status)
        |                             |        +--:(exception-thrown)
        |                             |        |  +--ro exception-thrown?   string
        |                             |        +--:(exited-normally)
        |                             |           +--ro exited-normally?   string
        |                             +--:(webhook) {wn-app:webhook-based-callouts}?
        |                                +--ro webhook-details
        |                                |  +--ro num-webhooks-configured    uint8
        |                                +--ro webhook-results
        |                                   +--ro webhook*
        |                                      +--ro name             string
        |                                      +--ro uri              ietf-inet-types:uri
        |                                      +--ro (result-type)?
        |                                         +--:(connection-error)
        |                                         |  +--ro connection-error?   string
        |                                         +--:(http-status-code)
        |                                            +--ro http-status-code    string
        +--ro lifecycle-statistics
        |  +--ro nbi-access-stats
        |  |  +--ro created               ietf-yang-types:date-and-time
        |  |  +--ro num-times-modified    uint16
        |  |  +--ro last-modified         ietf-yang-types:date-and-time
        |  +--ro sbi-access-stats
        |     +--ro num-times-accessed    uint16
        |     +--ro first-accessed        ietf-yang-types:date-and-time
        |     +--ro last-accessed         ietf-yang-types:date-and-time
        +--rw device-type                      -> /device-types/device-type/name

Device records are keyed by serial number, enabling device to tenant mapping, as serial numbers are globally unique.

Each device record includes the device’s lifecycle statistics (key north and south bound interactions) and bootstrapping log (a history of device-initiated interactions)

The device records are used in constructing RFC 8572 based “redirect” and “onboarding” information responses.

5.1.9 Dynamic Callouts

The following tree diagram illustrates the NBI used for configuring dynamic callouts, which may either be implemented via a call into a plugin or via a webhook¹.

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

  +--rw dynamic-callouts
     +--rw dynamic-callout* [name]
        +--rw name             string
        +--rw rpc-supported    identityref
        +--rw (callout-type)
           +--:(use-callback)
           |  +--rw callback
           |     +--rw plugin      -> /preferences/system/plugins/plugin/name
           |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functi\
ons/function/name
           +--:(use-webhooks) {wn-app:webhook-based-callouts}?
              +--rw webhooks
                 +--rw webhook* [name]
                 |  +--rw name          string
                 |  +--rw encoding?     enumeration <json>
                 |  +--rw (transport)
                 |     +--:(https) {ietf-restconf-client:https-initiate}?
                 |     |  +--rw https
                 |     |     +--rw tcp-client-parameters
                 |     |     |  +--rw remote-address    ietf-inet-types:host
                 |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
                 |     |     +--rw tls-client-parameters
                 |     |     |  +--rw client-identity!
                 |     |     |  |  +--rw (auth-type)
                 |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
                 |     |     |  |        +--rw certificate
                 |     |     |  |           +--rw (local-or-keystore)
                 |     |     |  |              +--:(local-keystore)
                 |     |     |  |                 +--rw local-keystore-reference
                 |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../\
../keystore/asymmetric-keys/asymmetric-key/name
                 |     |     |  |                    +--rw certificate       -> ../../../../../../../../../\
../keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]/certificates/certificate/name
                 |     |     |  +--rw server-authentication
                 |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
                 |     |     |     |  +--rw (local-or-truststore)
                 |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
                 |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../\
../truststore/certificate-bags/certificate-bag/name
                 |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
                 |     |     |        +--rw (local-or-truststore)
                 |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
                 |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../\
../truststore/certificate-bags/certificate-bag/name
                 |     |     +--rw http-client-parameters
                 |     |     |  +--rw client-identity!
                 |     |     |     +--rw (auth-type)
                 |     |     |        +--:(basic)
                 |     |     |           +--rw basic {ietf-http-client:basic-auth}?
                 |     |     |              +--rw user-id           string
                 |     |     |              +--rw (password-type)
                 |     |     |                 +--:(cleartext-password)
                 |     |     |                    +--rw cleartext-password?   string
                 |     |     +--rw restconf-client-parameters
                 |     +--:(http)
                 |        +--rw http
                 |           +--rw tcp-client-parameters
                 |           |  +--rw remote-address    ietf-inet-types:host
                 |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
                 |           +--rw http-client-parameters
                 |              +--rw client-identity!
                 |                 +--rw (auth-type)
                 |                    +--:(basic)
                 |                       +--rw basic {ietf-http-client:basic-auth}?
                 |                          +--rw user-id           string
                 |                          +--rw (password-type)
                 |                             +--:(cleartext-password)
                 |                                +--rw cleartext-password?   string
                 +--rw round-robin!
                    +--rw amount    uint16
                    +--rw units     enumeration

5.1.10 Keystore

The following tree diagram illustrates the NBI used for configuring keys held in the keystore.

  +--rw keystore
     +--rw asymmetric-keys
     |  +--rw asymmetric-key* [name]
     |     +--rw name                                   string
     |     +--rw public-key-format                      identityref
     |     +--rw public-key                             binary
     |     +--rw private-key-format?                    identityref
     |     +--rw (private-key-type)
     |     |  +--:(cleartext-private-key)
     |     |  |  +--rw cleartext-private-key?   binary
     |     |  +--:(hidden-private-key)
     |     |     +--rw hidden-private-key?   empty
     |     +--rw certificates
     |     |  +--rw certificate* [name]
     |     |     +--rw name                          string
     |     |     +--rw cert-data                     ietf-crypto-types:end-entity-cert-cms
     |     |     +--ro reference-statistics
     |     |        +--ro reference-count    uint32
     |     |        +--ro last-referenced    union
     |     +--ro reference-statistics
     |        +--ro reference-count    uint32
     |        +--ro last-referenced    union
     +--rw symmetric-keys
        +--rw symmetric-key* [name]
           +--rw name          string
           +--rw key-format?   identityref
           +--rw (key-type)
              +--:(cleartext-key)
              |  +--rw cleartext-key?   binary
              +--:(hidden-key)
                 +--rw hidden-key?   empty

The keys held in the keystore are used in the transport configuration, e.g., to hold SZTPD’s private key used for each listening port (see the Listening Ports and the APIs They Present in the Installation Guide).

5.1.11 Preferences

The following tree diagram illustrates the NBI used for configuring system and tenant-level preferences.

  +--rw preferences
     +--rw admin-accounts
     |  +--rw new-account-verification
     |  |  +--rw subject?   string <SZTPD new account verification required.>
     |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
     |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
     |  +--rw passwords
     |     +--rw strength-testing!
     |        +--rw min-length?   uint16 <16>
     +--rw notification-delivery!
     |  +--rw dynamic-callout
     |     +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
     +--rw system
        +--rw hostname?             ietf-inet-types:host
        +--rw email-from-address?   string <SZTPD Administrator <root@$SZTP-SERVER-ADDRESS>>
        +--rw features
        |  +--rw onboarding-supported?   boolean <true> {wn-sztpd-0:onboarding-supported}?
        +--rw plugins
           +--rw plugin* [name]
              +--rw name         string
              +--rw functions
                 +--rw function* [name]
                    +--rw name    string

5.1.12 Scripts

The following tree diagram illustrates the NBI used for configuring script records.

  +--rw scripts {wn-sztpd-0:onboarding-supported}?
     +--rw pre-configuration-script* [name]
     |  +--rw name                          string
     |  +--rw script?                       ietf-sztp-conveyed-info:script
     |  +--ro reference-statistics
     |     +--ro reference-count    uint32
     |     +--ro last-referenced    union
     +--rw post-configuration-script* [name]
        +--rw name                          string
        +--rw script?                       ietf-sztp-conveyed-info:script
        +--ro reference-statistics
           +--ro reference-count    uint32
           +--ro last-referenced    union

The script records are used in constructing RFC 8572 based “onboarding information” responses.

5.1.13 Tenants

For deployments using product mode ‘x’, the following tree diagram illustrates a snippet of the NBI used for configuring tenants.

  +--rw tenants
     +--rw tenant* [name]

Unlike all the other Northbound Interface sections, this section illustrates only the place in the hierarchy where the tenant containers are defined. Not shown are that each tenant container contains an instance of every other Northbound Interface section in it as well (with exception to the transport, which can only be configured by the host system.

5.1.14 Transport

The following tree diagram illustrates the NBI used for configuring transport records.

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

  +--rw transport
     +--rw listen! {ietf-restconf-server:http-listen or ietf-restconf-server:https-listen}?
        +--rw endpoint* [name]
           +--rw name          string
           +--rw (transport)
           |  +--:(http) {ietf-restconf-server:http-listen}?
           |  |  +--rw http
           |  |     +--rw external-endpoint!
           |  |     |  +--rw address    ietf-inet-types:ip-address
           |  |     |  +--rw port?      ietf-inet-types:port-number <443>
           |  |     +--rw tcp-server-parameters
           |  |     |  +--rw local-address    ietf-inet-types:ip-address
           |  |     |  +--rw local-port?      ietf-inet-types:port-number <80>
           |  |     +--rw http-server-parameters
           |  |     |  +--rw server-name?             string
           |  |     +--rw restconf-server-parameters
           |  |        +--rw client-identity-mappings
           |  |           +--rw cert-to-name* [id]
           |  |              +--rw id             uint32
           |  |              +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
           |  |              +--rw map-type       identityref
           |  |              +--rw name           string
           |  +--:(https) {ietf-restconf-server:https-listen}?
           |     +--rw https
           |        +--rw tcp-server-parameters
           |        |  +--rw local-address    ietf-inet-types:ip-address
           |        |  +--rw local-port?      ietf-inet-types:port-number <443>
           |        +--rw tls-server-parameters
           |        |  +--rw server-identity
           |        |  |  +--rw (auth-type)
           |        |  |     +--:(certificate) {ietf-tls-server:x509-certificate-auth}?
           |        |  |        +--rw certificate
           |        |  |           +--rw (local-or-keystore)
           |        |  |              +--:(local-keystore)
           |        |  |                 +--rw reference
           |        |  |                    +--rw asymmetric-key?   -> /keystore/asymmetric-keys/asymmetric\
-key/name
           |        |  |                    +--rw certificate?      -> /keystore/asymmetric-keys/asymmetric\
-key[name = current()/../asymmetric-key]/certificates/certificate/name
           |        |  +--rw client-authentication! {ietf-tls-server:client-auth-config-supported}?
           |        |     +--rw ca-certs! {ietf-tls-server:x509-certificate-auth}?
           |        |     |  +--rw (local-or-truststore)
           |        |     |     +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client\
-auth-config-supported}?
           |        |     |        +--rw local-truststore-reference?   -> /truststore/certificate-bags/cert\
ificate-bag/name
           |        |     +--rw ee-certs! {ietf-tls-server:x509-certificate-auth}?
           |        |        +--rw (local-or-truststore)
           |        |           +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client\
-auth-config-supported}?
           |        |              +--rw local-truststore-reference?   -> /truststore/certificate-bags/cert\
ificate-bag/name
           |        +--rw http-server-parameters
           |        |  +--rw server-name?             string
           |        +--rw restconf-server-parameters
           |           +--rw client-identity-mappings
           |              +--rw cert-to-name* [id]
           |                 +--rw id             uint32
           |                 +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
           |                 +--rw map-type       identityref
           |                 +--rw name           string
           +--rw use-for       enumeration

Each device records includes the device’s bootstrapping log, a history of interactions with the device.

The transport configuration defines the listening ports SZTPD opens.

5.1.15 Truststore

The following tree diagram illustrates the NBI used for configuring trust-anchors held in the truststore.

  +--rw truststore
     +--rw certificate-bags! {ietf-truststore:certificates}?
        +--rw certificate-bag* [name]
           +--rw name                          string
           +--rw description?                  string
           +--rw certificate* [name]
           |  +--rw name                          string
           |  +--rw cert-data                     ietf-crypto-types:trust-anchor-cert-cms
           |  +--ro reference-statistics
           |     +--ro reference-count    uint32
           |     +--ro last-referenced    union
           +--ro reference-statistics
              +--ro reference-count    uint32
              +--ro last-referenced    union

The trust-anchors held in the truststore are use for many purposes (e.g., to authenticate clients, to authenticate remote systems, etc.).

5.2.1 Triggers

5.2.2 Tracking

Much of SZTPD’s reactive functionality depends on triggers.

5.2.3 Dynamic Callouts

SZTPD uses “dynamic callouts” to send data to or request data from another system. Each dynamic callout may be implemented as a plugin (in order to use a proprietary API) or as a “webhook”, which is an HTTP “POST” request.

5.3.1 Mode-1’s native view

The following tree diagram illustrates the entire NBI, from the perspective of the Mode ‘1’ native interface.

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

module: wn-sztpd-1
  +--rw preferences
  |  +--rw admin-accounts
  |  |  +--rw new-account-verification
  |  |  |  +--rw subject?   string <SZTPD new account verification required.>
  |  |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
  |  |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
  |  |  +--rw passwords
  |  |     +--rw strength-testing!
  |  |        +--rw min-length?   uint16 <16>
  |  +--rw notification-delivery!
  |  |  +--rw dynamic-callout
  |  |     +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
  |  +--rw system
  |     +--rw hostname?             ietf-inet-types:host
  |     +--rw email-from-address?   string <SZTPD Administrator <root@$SZTP-SERVER-ADDRESS>>
  |     +--rw features
  |     |  +--rw onboarding-supported?   boolean <true> {wn-sztpd-0:onboarding-supported}?
  |     +--rw plugins
  |        +--rw plugin* [name]
  |           +--rw name         string
  |           +--rw functions
  |              +--rw function* [name]
  |                 +--rw name    string
  +--rw admin-accounts
  |  +--rw admin-account* [email-address]
  |     +--rw email-address                      string
  |     +--rw fullname?                          string
  |     +--rw password                           iana-crypt-hash:crypt-hash
  |     +--ro password-last-modified             ietf-yang-types:date-and-time
  |     +--rw access                             enumeration
  |     +---x resend-activation-email
  +--ro audit-log
  |  +--ro log-entry*
  |     +--ro timestamp         ietf-yang-types:date-and-time
  |     +--ro source-ip         ietf-inet-types:ip-address
  |     +--ro source-proxies*   string
  |     +--ro host              string
  |     +--ro method            enumeration
  |     +--ro path              string
  |     +--ro outcome           enumeration
  |     +--ro comment?          string
  +--rw truststore
  |  +--rw certificate-bags! {ietf-truststore:certificates}?
  |     +--rw certificate-bag* [name]
  |        +--rw name                          string
  |        +--rw description?                  string
  |        +--rw certificate* [name]
  |        |  +--rw name                          string
  |        |  +--rw cert-data                     ietf-crypto-types:trust-anchor-cert-cms
  |        |  +--ro reference-statistics
  |        |     +--ro reference-count    uint32
  |        |     +--ro last-referenced    union
  |        +--ro reference-statistics
  |           +--ro reference-count    uint32
  |           +--ro last-referenced    union
  +--rw keystore {not system-level-administration-disabled}?
  |  +--rw asymmetric-keys
  |  |  +--rw asymmetric-key* [name]
  |  |     +--rw name                                   string
  |  |     +--rw public-key-format                      identityref
  |  |     +--rw public-key                             binary
  |  |     +--rw private-key-format?                    identityref
  |  |     +--rw (private-key-type)
  |  |     |  +--:(cleartext-private-key)
  |  |     |  |  +--rw cleartext-private-key?   binary
  |  |     |  +--:(hidden-private-key)
  |  |     |     +--rw hidden-private-key?   empty
  |  |     +--rw certificates
  |  |     |  +--rw certificate* [name]
  |  |     |     +--rw name                          string
  |  |     |     +--rw cert-data                     ietf-crypto-types:end-entity-cert-cms
  |  |     |     +--ro reference-statistics
  |  |     |        +--ro reference-count    uint32
  |  |     |        +--ro last-referenced    union
  |  |     +--ro reference-statistics
  |  |        +--ro reference-count    uint32
  |  |        +--ro last-referenced    union
  |  +--rw symmetric-keys
  |     +--rw symmetric-key* [name]
  |        +--rw name          string
  |        +--rw key-format?   identityref
  |        +--rw (key-type)
  |           +--:(cleartext-key)
  |           |  +--rw cleartext-key?   binary
  |           +--:(hidden-key)
  |              +--rw hidden-key?   empty
  +--rw dynamic-callouts
  |  +--rw dynamic-callout* [name]
  |     +--rw name             string
  |     +--rw rpc-supported    identityref
  |     +--rw (callout-type)
  |        +--:(use-callback)
  |        |  +--rw callback
  |        |     +--rw plugin      -> /preferences/system/plugins/plugin/name
  |        |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functi\
ons/function/name
  |        +--:(use-webhooks) {wn-app:webhook-based-callouts}?
  |           +--rw webhooks
  |              +--rw webhook* [name]
  |              |  +--rw name          string
  |              |  +--rw encoding?     enumeration <json>
  |              |  +--rw (transport)
  |              |     +--:(https) {ietf-restconf-client:https-initiate}?
  |              |     |  +--rw https
  |              |     |     +--rw tcp-client-parameters
  |              |     |     |  +--rw remote-address    ietf-inet-types:host
  |              |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |              |     |     +--rw tls-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |  |  +--rw (auth-type)
  |              |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |  |        +--rw certificate
  |              |     |     |  |           +--rw (local-or-keystore)
  |              |     |     |  |              +--:(local-keystore)
  |              |     |     |  |                 +--rw local-keystore-reference
  |              |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../\
../keystore/asymmetric-keys/asymmetric-key/name
  |              |     |     |  |                    +--rw certificate       -> ../../../../../../../../../\
../keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]/certificates/certificate/name
  |              |     |     |  +--rw server-authentication
  |              |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |     |  +--rw (local-or-truststore)
  |              |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../\
../truststore/certificate-bags/certificate-bag/name
  |              |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |        +--rw (local-or-truststore)
  |              |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../\
../truststore/certificate-bags/certificate-bag/name
  |              |     |     +--rw http-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |     +--rw (auth-type)
  |              |     |     |        +--:(basic)
  |              |     |     |           +--rw basic {ietf-http-client:basic-auth}?
  |              |     |     |              +--rw user-id           string
  |              |     |     |              +--rw (password-type)
  |              |     |     |                 +--:(cleartext-password)
  |              |     |     |                    +--rw cleartext-password?   string
  |              |     |     +--rw restconf-client-parameters
  |              |     +--:(http)
  |              |        +--rw http
  |              |           +--rw tcp-client-parameters
  |              |           |  +--rw remote-address    ietf-inet-types:host
  |              |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
  |              |           +--rw http-client-parameters
  |              |              +--rw client-identity!
  |              |                 +--rw (auth-type)
  |              |                    +--:(basic)
  |              |                       +--rw basic {ietf-http-client:basic-auth}?
  |              |                          +--rw user-id           string
  |              |                          +--rw (password-type)
  |              |                             +--:(cleartext-password)
  |              |                                +--rw cleartext-password?   string
  |              +--rw round-robin!
  |                 +--rw amount    uint16
  |                 +--rw units     enumeration
  +--rw transport {not system-level-administration-disabled}?
  |  +--rw listen! {ietf-restconf-server:http-listen or ietf-restconf-server:https-listen}?
  |     +--rw endpoint* [name]
  |        +--rw name          string
  |        +--rw (transport)
  |        |  +--:(http) {ietf-restconf-server:http-listen}?
  |        |  |  +--rw http
  |        |  |     +--rw external-endpoint!
  |        |  |     |  +--rw address    ietf-inet-types:ip-address
  |        |  |     |  +--rw port?      ietf-inet-types:port-number <443>
  |        |  |     +--rw tcp-server-parameters
  |        |  |     |  +--rw local-address    ietf-inet-types:ip-address
  |        |  |     |  +--rw local-port?      ietf-inet-types:port-number <80>
  |        |  |     +--rw http-server-parameters
  |        |  |     |  +--rw server-name?             string
  |        |  |     +--rw restconf-server-parameters
  |        |  |        +--rw client-identity-mappings
  |        |  |           +--rw cert-to-name* [id]
  |        |  |              +--rw id             uint32
  |        |  |              +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |  |              +--rw map-type       identityref
  |        |  |              +--rw name           string
  |        |  +--:(https) {ietf-restconf-server:https-listen}?
  |        |     +--rw https
  |        |        +--rw tcp-server-parameters
  |        |        |  +--rw local-address    ietf-inet-types:ip-address
  |        |        |  +--rw local-port?      ietf-inet-types:port-number <443>
  |        |        +--rw tls-server-parameters
  |        |        |  +--rw server-identity
  |        |        |  |  +--rw (auth-type)
  |        |        |  |     +--:(certificate) {ietf-tls-server:x509-certificate-auth}?
  |        |        |  |        +--rw certificate
  |        |        |  |           +--rw (local-or-keystore)
  |        |        |  |              +--:(local-keystore)
  |        |        |  |                 +--rw reference
  |        |        |  |                    +--rw asymmetric-key?   -> /keystore/asymmetric-keys/asymmetric\
-key/name
  |        |        |  |                    +--rw certificate?      -> /keystore/asymmetric-keys/asymmetric\
-key[name = current()/../asymmetric-key]/certificates/certificate/name
  |        |        |  +--rw client-authentication! {ietf-tls-server:client-auth-config-supported}?
  |        |        |     +--rw ca-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |     |  +--rw (local-or-truststore)
  |        |        |     |     +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client\
-auth-config-supported}?
  |        |        |     |        +--rw local-truststore-reference?   -> /truststore/certificate-bags/cert\
ificate-bag/name
  |        |        |     +--rw ee-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |        +--rw (local-or-truststore)
  |        |        |           +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client\
-auth-config-supported}?
  |        |        |              +--rw local-truststore-reference?   -> /truststore/certificate-bags/cert\
ificate-bag/name
  |        |        +--rw http-server-parameters
  |        |        |  +--rw server-name?             string
  |        |        +--rw restconf-server-parameters
  |        |           +--rw client-identity-mappings
  |        |              +--rw cert-to-name* [id]
  |        |                 +--rw id             uint32
  |        |                 +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |                 +--rw map-type       identityref
  |        |                 +--rw name           string
  |        +--rw use-for       enumeration
  +--rw device-types
  |  +--rw device-type* [name]
  |     +--rw name                       string
  |     +--rw identity-certificates!
  |     |  +--rw verification
  |     |  |  +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |  |     +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |  |     +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/\
../certificate-bag]/certificate/name
  |     |  +--rw serial-number-extraction?   identityref <wn-x509-c2n:serial-number>
  |     +--rw ownership-authorization!
  |     |  +--rw dynamic-callout
  |     |     +--rw reference?   -> /dynamic-callouts/dynamic-callout/name
  |     +--rw voucher-aquisition!
  |        +--rw dynamic-callout
  |           +--rw reference?   -> /dynamic-callouts/dynamic-callout/name
  +--rw bootstrap-servers
  |  +--rw bootstrap-server* [name]
  |     +--rw name                          string
  |     +--rw address                       ietf-inet-types:host
  |     +--rw port?                         ietf-inet-types:port-number <443>
  |     +--rw trust-anchor?                 ietf-crypto-types:trust-anchor-cert-cms
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw boot-images {wn-sztpd-0:onboarding-supported}?
  |  +--rw boot-image* [name]
  |     +--rw name                          string
  |     +--rw os-name?                      string
  |     +--rw os-version?                   string
  |     +--rw download-uri*                 ietf-inet-types:uri
  |     +--rw image-verification* [hash-algorithm]
  |     |  +--rw hash-algorithm    identityref
  |     |  +--rw hash-value        ietf-yang-types:hex-string
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw scripts {wn-sztpd-0:onboarding-supported}?
  |  +--rw pre-configuration-script* [name]
  |  |  +--rw name                          string
  |  |  +--rw script?                       ietf-sztp-conveyed-info:script
  |  |  +--ro reference-statistics
  |  |     +--ro reference-count    uint32
  |  |     +--ro last-referenced    union
  |  +--rw post-configuration-script* [name]
  |     +--rw name                          string
  |     +--rw script?                       ietf-sztp-conveyed-info:script
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw configurations {wn-sztpd-0:onboarding-supported}?
  |  +--rw configuration* [name]
  |     +--rw name                          string
  |     +--rw configuration-handling?       enumeration
  |     +--rw config?                       binary
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw conveyed-information-responses
  |  +--rw redirect-information-response* [name]
  |  |  +--rw name                          string
  |  |  +--rw redirect-information
  |  |  |  +--rw bootstrap-server*   -> ../../../../bootstrap-servers/bootstrap-server/name
  |  |  +--ro reference-statistics
  |  |     +--ro reference-count    uint32
  |  |     +--ro last-referenced    union
  |  +--rw onboarding-information-response* [name] {wn-sztpd-0:onboarding-supported}?
  |     +--rw name                          string
  |     +--rw onboarding-information
  |     |  +--rw boot-image                   -> ../../../../boot-images/boot-image/name
  |     |  +--rw pre-configuration-script?    -> ../../../../scripts/pre-configuration-script/name
  |     |  +--rw configuration?               -> ../../../../configurations/configuration/name
  |     |  +--rw post-configuration-script?   -> ../../../../scripts/post-configuration-script/name
  |     +--ro reference-statistics
  |        +--ro reference-count    uint32
  |        +--ro last-referenced    union
  +--rw devices
     +--rw device* [serial-number]
        +--rw serial-number                    string
        +--rw activation-code?                 iana-crypt-hash:crypt-hash
        +--rw response-manager
        |  +--rw matched-response* [name]
        |     +--rw name              string
        |     +--rw match-criteria!
        |     |  +--rw match* [key]
        |     |     +--rw key           string
        |     |     +--rw not?          empty
        |     |     +--rw (test-type)
        |     |        +--:(present)
        |     |        |  +--rw present?   empty
        |     |        +--:(value)
        |     |        |  +--rw value?   string
        |     |        +--:(regex)
        |     |           +--rw regex?   string
        |     +--rw response
        |        +--rw reporting-level?     enumeration <minimal> {wn-sztpd-0:onboarding-supported}?
        |        +--rw (response-handler)
        |           +--:(none)
        |           |  +--rw none?   empty
        |           +--:(managed-response)
        |              +--rw conveyed-information
        |                 +--rw (conveyed-information-handler)
        |                    +--:(use-dynamic-callout)
        |                    |  +--rw dynamic-callout
        |                    |     +--rw reference?   -> ../../../../../../../../dynamic-callouts/dynamic-c\
allout/name
        |                    +--:(redirect-information)
        |                    |  +--rw redirect-information
        |                    |     +--rw (local-or-reference)
        |                    |        +--:(reference)
        |                    |           +--rw reference?   -> ../../../../../../../../conveyed-information\
-responses/redirect-information-response/name
        |                    +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |                       +--rw onboarding-information
        |                          +--rw (local-or-reference)
        |                             +--:(reference)
        |                                +--rw reference?   -> ../../../../../../../../conveyed-information\
-responses/onboarding-information-response/name
        +---n progress-report-received
           +--ro progress-report?   anydata
        +--ro bootstrapping-log
        |  +--ro log-entry*
        |     +--ro timestamp         ietf-yang-types:date-and-time
        |     +--ro source-ip         ietf-inet-types:ip-address
        |     +--ro method            string
        |     +--ro path              string
        |     +--ro return-code       uint16
        |     +--ro error-returned?   anydata
        |     +--ro event-details
        |        +--ro (event-type)
        |           +--:(get-bootstrapping-data-event)
        |           |  +--ro get-bootstrapping-data-event
        |           |     +--ro passed-input
        |           |     |  +--ro (input-type)
        |           |     |     +--:(no-input-passed)
        |           |     |     |  +--ro no-input-passed?   empty
        |           |     |     +--:(input)
        |           |     |        +--ro input*
        |           |     |           +--ro key      string
        |           |     |           +--ro value    anydata
        |           |     +--ro selected-response?        union
        |           |     +--ro response-details
        |           |        +--ro (response-type)
        |           |           +--:(managed-response)
        |           |              +--ro managed-response
        |           |                 +--ro conveyed-information
        |           |                    +--ro (conveyed-information-handler)
        |           |                       +--:(dynamic-callout)
        |           |                       |  +--ro dynamic-callout
        |           |                       |     +--ro (result-type)?
        |           |                       |        +--:(no-callout-configured)
        |           |                       |        |  +--ro no-callout-configured?   empty
        |           |                       |        +--:(callout-configured)
        |           |                       |           +--ro name                     string
        |           |                       |           +--ro rpc-supported            identityref
        |           |                       |           +--ro callout-type             enumeration
        |           |                       |           +--ro (callback-or-webhook)?
        |           |                       |              +--:(callback)
        |           |                       |              |  +--ro callback-details
        |           |                       |              |  |  +--ro plugin      string
        |           |                       |              |  |  +--ro function    string
        |           |                       |              |  +--ro callback-results
        |           |                       |              |     +--ro (exit-status)
        |           |                       |              |        +--:(exception-thrown)
        |           |                       |              |        |  +--ro exception-thrown?   string
        |           |                       |              |        +--:(exited-normally)
        |           |                       |              |           +--ro exited-normally?   string
        |           |                       |              +--:(webhook) {wn-app:webhook-based-callouts}?
        |           |                       |                 +--ro webhook-details
        |           |                       |                 |  +--ro num-webhooks-configured    uint8
        |           |                       |                 +--ro webhook-results
        |           |                       |                    +--ro webhook*
        |           |                       |                       +--ro name             string
        |           |                       |                       +--ro uri              ietf-inet-types:\
uri
        |           |                       |                       +--ro (result-type)?
        |           |                       |                          +--:(connection-error)
        |           |                       |                          |  +--ro connection-error?   string
        |           |                       |                          +--:(http-status-code)
        |           |                       |                             +--ro http-status-code    string
        |           |                       +--:(redirect-information)
        |           |                       |  +--ro redirect-information
        |           |                       |     +--ro (local-or-reference)
        |           |                       |        +--:(reference)
        |           |                       |           +--ro referenced-definition?   string
        |           |                       +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
        |           |                          +--ro onboarding-information
        |           |                             +--ro (local-or-reference)
        |           |                                +--:(reference)
        |           |                                   +--ro referenced-definition?   string
        |           +--:(report-progress-event) {wn-sztpd-0:onboarding-supported}?
        |              +--ro report-progress-event
        |                 +--ro passed-input
        |                 |  +--ro progress-type         string
        |                 |  +--ro message?              string
        |                 |  +--ro ssh-host-keys?        anydata
        |                 |  +--ro trust-anchor-certs?   anydata
        |                 +--ro dynamic-callout
        |                    +--ro (result-type)?
        |                       +--:(no-callout-configured)
        |                       |  +--ro no-callout-configured?   empty
        |                       +--:(callout-configured)
        |                          +--ro name                     string
        |                          +--ro rpc-supported            identityref
        |                          +--ro callout-type             enumeration
        |                          +--ro (callback-or-webhook)?
        |                             +--:(callback)
        |                             |  +--ro callback-details
        |                             |  |  +--ro plugin      string
        |                             |  |  +--ro function    string
        |                             |  +--ro callback-results
        |                             |     +--ro (exit-status)
        |                             |        +--:(exception-thrown)
        |                             |        |  +--ro exception-thrown?   string
        |                             |        +--:(exited-normally)
        |                             |           +--ro exited-normally?   string
        |                             +--:(webhook) {wn-app:webhook-based-callouts}?
        |                                +--ro webhook-details
        |                                |  +--ro num-webhooks-configured    uint8
        |                                +--ro webhook-results
        |                                   +--ro webhook*
        |                                      +--ro name             string
        |                                      +--ro uri              ietf-inet-types:uri
        |                                      +--ro (result-type)?
        |                                         +--:(connection-error)
        |                                         |  +--ro connection-error?   string
        |                                         +--:(http-status-code)
        |                                            +--ro http-status-code    string
        +--ro lifecycle-statistics
        |  +--ro nbi-access-stats
        |  |  +--ro created               ietf-yang-types:date-and-time
        |  |  +--ro num-times-modified    uint16
        |  |  +--ro last-modified         ietf-yang-types:date-and-time
        |  +--ro sbi-access-stats
        |     +--ro num-times-accessed    uint16
        |     +--ro first-accessed        ietf-yang-types:date-and-time
        |     +--ro last-accessed         ietf-yang-types:date-and-time
        +--rw device-type                      -> /device-types/device-type/name

5.3.2 Mode-X’s native view

The following tree diagram illustrates the entire NBI, from the perspective of the Mode ‘x’ native interface (not the tenant interface.

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

module: wn-sztpd-x
  +--rw device-types
  |  +--rw device-type* [name]
  |     +--rw name                       string
  |     +--rw identity-certificates!
  |     |  +--rw verification
  |     |  |  +--rw local-truststore-reference {ietf-truststore:certificates}?
  |     |  |     +--rw certificate-bag    -> /truststore/certificate-bags/certificate-bag/name
  |     |  |     +--rw certificate        -> /truststore/certificate-bags/certificate-bag[name = current()/\
../certificate-bag]/certificate/name
  |     |  +--rw serial-number-extraction?   identityref <wn-x509-c2n:serial-number>
  |     +--rw ownership-authorization!
  |     |  +--rw dynamic-callout
  |     |     +--rw reference?   -> /dynamic-callouts/dynamic-callout/name
  |     +--rw voucher-aquisition!
  |        +--rw dynamic-callout
  |           +--rw reference?   -> /dynamic-callouts/dynamic-callout/name
  +--rw preferences
  |  +--rw admin-accounts
  |  |  +--rw new-account-verification
  |  |  |  +--rw subject?   string <SZTPD new account verification required.>
  |  |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
  |  |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
  |  |  +--rw passwords
  |  |     +--rw strength-testing!
  |  |        +--rw min-length?   uint16 <16>
  |  +--rw notification-delivery!
  |  |  +--rw dynamic-callout
  |  |     +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
  |  +--rw system
  |     +--rw hostname?             ietf-inet-types:host
  |     +--rw email-from-address?   string <SZTPD Administrator <root@$SZTP-SERVER-ADDRESS>>
  |     +--rw features
  |     |  +--rw onboarding-supported?   boolean <true> {wn-sztpd-0:onboarding-supported}?
  |     +--rw plugins
  |        +--rw plugin* [name]
  |           +--rw name         string
  |           +--rw functions
  |              +--rw function* [name]
  |                 +--rw name    string
  +--rw admin-accounts
  |  +--rw admin-account* [email-address]
  |     +--rw email-address                      string
  |     +--rw fullname?                          string
  |     +--rw password                           iana-crypt-hash:crypt-hash
  |     +--ro password-last-modified             ietf-yang-types:date-and-time
  |     +--rw access                             enumeration
  |     +---x resend-activation-email
  +--ro audit-log
  |  +--ro log-entry*
  |     +--ro timestamp         ietf-yang-types:date-and-time
  |     +--ro source-ip         ietf-inet-types:ip-address
  |     +--ro source-proxies*   string
  |     +--ro host              string
  |     +--ro method            enumeration
  |     +--ro path              string
  |     +--ro outcome           enumeration
  |     +--ro comment?          string
  +--rw truststore
  |  +--rw certificate-bags! {ietf-truststore:certificates}?
  |     +--rw certificate-bag* [name]
  |        +--rw name                          string
  |        +--rw description?                  string
  |        +--rw certificate* [name]
  |        |  +--rw name                          string
  |        |  +--rw cert-data                     ietf-crypto-types:trust-anchor-cert-cms
  |        |  +--ro reference-statistics
  |        |     +--ro reference-count    uint32
  |        |     +--ro last-referenced    union
  |        +--ro reference-statistics
  |           +--ro reference-count    uint32
  |           +--ro last-referenced    union
  +--rw keystore
  |  +--rw asymmetric-keys
  |  |  +--rw asymmetric-key* [name]
  |  |     +--rw name                                   string
  |  |     +--rw public-key-format                      identityref
  |  |     +--rw public-key                             binary
  |  |     +--rw private-key-format?                    identityref
  |  |     +--rw (private-key-type)
  |  |     |  +--:(cleartext-private-key)
  |  |     |  |  +--rw cleartext-private-key?   binary
  |  |     |  +--:(hidden-private-key)
  |  |     |     +--rw hidden-private-key?   empty
  |  |     +--rw certificates
  |  |     |  +--rw certificate* [name]
  |  |     |     +--rw name                          string
  |  |     |     +--rw cert-data                     ietf-crypto-types:end-entity-cert-cms
  |  |     |     +--ro reference-statistics
  |  |     |        +--ro reference-count    uint32
  |  |     |        +--ro last-referenced    union
  |  |     +--ro reference-statistics
  |  |        +--ro reference-count    uint32
  |  |        +--ro last-referenced    union
  |  +--rw symmetric-keys
  |     +--rw symmetric-key* [name]
  |        +--rw name          string
  |        +--rw key-format?   identityref
  |        +--rw (key-type)
  |           +--:(cleartext-key)
  |           |  +--rw cleartext-key?   binary
  |           +--:(hidden-key)
  |              +--rw hidden-key?   empty
  +--rw dynamic-callouts
  |  +--rw dynamic-callout* [name]
  |     +--rw name             string
  |     +--rw rpc-supported    identityref
  |     +--rw (callout-type)
  |        +--:(use-callback)
  |        |  +--rw callback
  |        |     +--rw plugin      -> /preferences/system/plugins/plugin/name
  |        |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/functi\
ons/function/name
  |        +--:(use-webhooks) {wn-app:webhook-based-callouts}?
  |           +--rw webhooks
  |              +--rw webhook* [name]
  |              |  +--rw name          string
  |              |  +--rw encoding?     enumeration <json>
  |              |  +--rw (transport)
  |              |     +--:(https) {ietf-restconf-client:https-initiate}?
  |              |     |  +--rw https
  |              |     |     +--rw tcp-client-parameters
  |              |     |     |  +--rw remote-address    ietf-inet-types:host
  |              |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
  |              |     |     +--rw tls-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |  |  +--rw (auth-type)
  |              |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |  |        +--rw certificate
  |              |     |     |  |           +--rw (local-or-keystore)
  |              |     |     |  |              +--:(local-keystore)
  |              |     |     |  |                 +--rw local-keystore-reference
  |              |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../../../\
../keystore/asymmetric-keys/asymmetric-key/name
  |              |     |     |  |                    +--rw certificate       -> ../../../../../../../../../\
../keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]/certificates/certificate/name
  |              |     |     |  +--rw server-authentication
  |              |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |     |  +--rw (local-or-truststore)
  |              |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../../../\
../truststore/certificate-bags/certificate-bag/name
  |              |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
  |              |     |     |        +--rw (local-or-truststore)
  |              |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
  |              |     |     |              +--rw local-truststore-reference?   -> ../../../../../../../../\
../truststore/certificate-bags/certificate-bag/name
  |              |     |     +--rw http-client-parameters
  |              |     |     |  +--rw client-identity!
  |              |     |     |     +--rw (auth-type)
  |              |     |     |        +--:(basic)
  |              |     |     |           +--rw basic {ietf-http-client:basic-auth}?
  |              |     |     |              +--rw user-id           string
  |              |     |     |              +--rw (password-type)
  |              |     |     |                 +--:(cleartext-password)
  |              |     |     |                    +--rw cleartext-password?   string
  |              |     |     +--rw restconf-client-parameters
  |              |     +--:(http)
  |              |        +--rw http
  |              |           +--rw tcp-client-parameters
  |              |           |  +--rw remote-address    ietf-inet-types:host
  |              |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
  |              |           +--rw http-client-parameters
  |              |              +--rw client-identity!
  |              |                 +--rw (auth-type)
  |              |                    +--:(basic)
  |              |                       +--rw basic {ietf-http-client:basic-auth}?
  |              |                          +--rw user-id           string
  |              |                          +--rw (password-type)
  |              |                             +--:(cleartext-password)
  |              |                                +--rw cleartext-password?   string
  |              +--rw round-robin!
  |                 +--rw amount    uint16
  |                 +--rw units     enumeration
  +--rw transport
  |  +--rw listen! {ietf-restconf-server:http-listen or ietf-restconf-server:https-listen}?
  |     +--rw endpoint* [name]
  |        +--rw name          string
  |        +--rw (transport)
  |        |  +--:(http) {ietf-restconf-server:http-listen}?
  |        |  |  +--rw http
  |        |  |     +--rw external-endpoint!
  |        |  |     |  +--rw address    ietf-inet-types:ip-address
  |        |  |     |  +--rw port?      ietf-inet-types:port-number <443>
  |        |  |     +--rw tcp-server-parameters
  |        |  |     |  +--rw local-address    ietf-inet-types:ip-address
  |        |  |     |  +--rw local-port?      ietf-inet-types:port-number <80>
  |        |  |     +--rw http-server-parameters
  |        |  |     |  +--rw server-name?             string
  |        |  |     +--rw restconf-server-parameters
  |        |  |        +--rw client-identity-mappings
  |        |  |           +--rw cert-to-name* [id]
  |        |  |              +--rw id             uint32
  |        |  |              +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |  |              +--rw map-type       identityref
  |        |  |              +--rw name           string
  |        |  +--:(https) {ietf-restconf-server:https-listen}?
  |        |     +--rw https
  |        |        +--rw tcp-server-parameters
  |        |        |  +--rw local-address    ietf-inet-types:ip-address
  |        |        |  +--rw local-port?      ietf-inet-types:port-number <443>
  |        |        +--rw tls-server-parameters
  |        |        |  +--rw server-identity
  |        |        |  |  +--rw (auth-type)
  |        |        |  |     +--:(certificate) {ietf-tls-server:x509-certificate-auth}?
  |        |        |  |        +--rw certificate
  |        |        |  |           +--rw (local-or-keystore)
  |        |        |  |              +--:(local-keystore)
  |        |        |  |                 +--rw reference
  |        |        |  |                    +--rw asymmetric-key?   -> /keystore/asymmetric-keys/asymmetric\
-key/name
  |        |        |  |                    +--rw certificate?      -> /keystore/asymmetric-keys/asymmetric\
-key[name = current()/../asymmetric-key]/certificates/certificate/name
  |        |        |  +--rw client-authentication! {ietf-tls-server:client-auth-config-supported}?
  |        |        |     +--rw ca-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |     |  +--rw (local-or-truststore)
  |        |        |     |     +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client\
-auth-config-supported}?
  |        |        |     |        +--rw local-truststore-reference?   -> /truststore/certificate-bags/cert\
ificate-bag/name
  |        |        |     +--rw ee-certs! {ietf-tls-server:x509-certificate-auth}?
  |        |        |        +--rw (local-or-truststore)
  |        |        |           +--:(local-truststore) {ietf-truststore:certificates,ietf-tls-server:client\
-auth-config-supported}?
  |        |        |              +--rw local-truststore-reference?   -> /truststore/certificate-bags/cert\
ificate-bag/name
  |        |        +--rw http-server-parameters
  |        |        |  +--rw server-name?             string
  |        |        +--rw restconf-server-parameters
  |        |           +--rw client-identity-mappings
  |        |              +--rw cert-to-name* [id]
  |        |                 +--rw id             uint32
  |        |                 +--rw fingerprint?   ietf-x509-cert-to-name:tls-fingerprint
  |        |                 +--rw map-type       identityref
  |        |                 +--rw name           string
  |        +--rw use-for       enumeration
  +--rw tenants
     +--rw tenant* [name]
        +--rw name                              string
        +--rw preferences
        |  +--rw admin-accounts
        |  |  +--rw new-account-verification
        |  |  |  +--rw subject?   string <SZTPD new account verification required.>
        |  |  |  +--rw cc?        string <$CREATOR-FULLNAME <CREATOR-EMAIL-ADDRESS>>
        |  |  |  +--rw body?      string <$ACCOUNT-FULLNAME,

You are receiving this email because I created a new account
for you on the SZTPD ($SZTP-SERVER-ADDRESS).   You
account's login is "$ACCOUNT-EMAIL-ADDRESS".

Please activate your account via the following URL:
$VERIFICATION-URI (This URL expires in 48-hours).

Note that I CC-ed myself on this email and you may contact
me to verify the veracity of this email.

Thanks,
$CREATOR-FULLNAME
>
        |  |  +--rw passwords
        |  |     +--rw strength-testing!
        |  |        +--rw min-length?   uint16 <16>
        |  +--rw notification-delivery!
        |     +--rw dynamic-callout
        |        +--rw reference    -> ../../../../dynamic-callouts/dynamic-callout/name
        +--rw admin-accounts
        |  +--rw admin-account* [email-address]
        |     +--rw email-address                      string
        |     +--rw fullname?                          string
        |     +--rw password                           iana-crypt-hash:crypt-hash
        |     +--ro password-last-modified             ietf-yang-types:date-and-time
        |     +--rw access                             enumeration
        |     +---x resend-activation-email
        +--ro audit-log
        |  +--ro log-entry*
        |     +--ro timestamp         ietf-yang-types:date-and-time
        |     +--ro source-ip         ietf-inet-types:ip-address
        |     +--ro source-proxies*   string
        |     +--ro host              string
        |     +--ro method            enumeration
        |     +--ro path              string
        |     +--ro outcome           enumeration
        |     +--ro comment?          string
        +--rw truststore
        |  +--rw certificate-bags! {ietf-truststore:certificates}?
        |     +--rw certificate-bag* [name]
        |        +--rw name                          string
        |        +--rw description?                  string
        |        +--rw certificate* [name]
        |        |  +--rw name                          string
        |        |  +--rw cert-data                     ietf-crypto-types:trust-anchor-cert-cms
        |        |  +--ro reference-statistics
        |        |     +--ro reference-count    uint32
        |        |     +--ro last-referenced    union
        |        +--ro reference-statistics
        |           +--ro reference-count    uint32
        |           +--ro last-referenced    union
        +--rw keystore
        |  +--rw asymmetric-keys
        |  |  +--rw asymmetric-key* [name]
        |  |     +--rw name                                   string
        |  |     +--rw public-key-format                      identityref
        |  |     +--rw public-key                             binary
        |  |     +--rw private-key-format?                    identityref
        |  |     +--rw (private-key-type)
        |  |     |  +--:(cleartext-private-key)
        |  |     |  |  +--rw cleartext-private-key?   binary
        |  |     |  +--:(hidden-private-key)
        |  |     |     +--rw hidden-private-key?   empty
        |  |     +--rw certificates
        |  |     |  +--rw certificate* [name]
        |  |     |     +--rw name                          string
        |  |     |     +--rw cert-data                     ietf-crypto-types:end-entity-cert-cms
        |  |     |     +--ro reference-statistics
        |  |     |        +--ro reference-count    uint32
        |  |     |        +--ro last-referenced    union
        |  |     +--ro reference-statistics
        |  |        +--ro reference-count    uint32
        |  |        +--ro last-referenced    union
        |  +--rw symmetric-keys
        |     +--rw symmetric-key* [name]
        |        +--rw name          string
        |        +--rw key-format?   identityref
        |        +--rw (key-type)
        |           +--:(cleartext-key)
        |           |  +--rw cleartext-key?   binary
        |           +--:(hidden-key)
        |              +--rw hidden-key?   empty
        +--rw dynamic-callouts
        |  +--rw dynamic-callout* [name]
        |     +--rw name             string
        |     +--rw rpc-supported    identityref
        |     +--rw (callout-type)
        |        +--:(use-callback)
        |        |  +--rw callback
        |        |     +--rw plugin      -> /preferences/system/plugins/plugin/name
        |        |     +--rw function    -> /preferences/system/plugins/plugin[name = current()/../plugin]/\
functions/function/name
        |        +--:(use-webhooks) {wn-app:webhook-based-callouts}?
        |           +--rw webhooks
        |              +--rw webhook* [name]
        |              |  +--rw name          string
        |              |  +--rw encoding?     enumeration <json>
        |              |  +--rw (transport)
        |              |     +--:(https) {ietf-restconf-client:https-initiate}?
        |              |     |  +--rw https
        |              |     |     +--rw tcp-client-parameters
        |              |     |     |  +--rw remote-address    ietf-inet-types:host
        |              |     |     |  +--rw remote-port?      ietf-inet-types:port-number <443>
        |              |     |     +--rw tls-client-parameters
        |              |     |     |  +--rw client-identity!
        |              |     |     |  |  +--rw (auth-type)
        |              |     |     |  |     +--:(certificate) {ietf-tls-client:x509-certificate-auth}?
        |              |     |     |  |        +--rw certificate
        |              |     |     |  |           +--rw (local-or-keystore)
        |              |     |     |  |              +--:(local-keystore)
        |              |     |     |  |                 +--rw local-keystore-reference
        |              |     |     |  |                    +--rw asymmetric-key    -> ../../../../../../../\
../../../keystore/asymmetric-keys/asymmetric-key/name
        |              |     |     |  |                    +--rw certificate       -> ../../../../../../../\
../../../keystore/asymmetric-keys/asymmetric-key[name = current()/../asymmetric-key]/certificates/certifica\
te/name
        |              |     |     |  +--rw server-authentication
        |              |     |     |     +--rw ca-certs! {ietf-tls-client:x509-certificate-auth}?
        |              |     |     |     |  +--rw (local-or-truststore)
        |              |     |     |     |     +--:(local-truststore) {ietf-truststore:certificates}?
        |              |     |     |     |        +--rw local-truststore-reference?   -> ../../../../../../\
../../../truststore/certificate-bags/certificate-bag/name
        |              |     |     |     +--rw ee-certs! {ietf-tls-client:x509-certificate-auth}?
        |              |     |     |        +--rw (local-or-truststore)
        |              |     |     |           +--:(local-truststore) {ietf-truststore:certificates}?
        |              |     |     |              +--rw local-truststore-reference?   -> ../../../../../../\
../../../truststore/certificate-bags/certificate-bag/name
        |              |     |     +--rw http-client-parameters
        |              |     |     |  +--rw client-identity!
        |              |     |     |     +--rw (auth-type)
        |              |     |     |        +--:(basic)
        |              |     |     |           +--rw basic {ietf-http-client:basic-auth}?
        |              |     |     |              +--rw user-id           string
        |              |     |     |              +--rw (password-type)
        |              |     |     |                 +--:(cleartext-password)
        |              |     |     |                    +--rw cleartext-password?   string
        |              |     |     +--rw restconf-client-parameters
        |              |     +--:(http)
        |              |        +--rw http
        |              |           +--rw tcp-client-parameters
        |              |           |  +--rw remote-address    ietf-inet-types:host
        |              |           |  +--rw remote-port?      ietf-inet-types:port-number <80>
        |              |           +--rw http-client-parameters
        |              |              +--rw client-identity!
        |              |                 +--rw (auth-type)
        |              |                    +--:(basic)
        |              |                       +--rw basic {ietf-http-client:basic-auth}?
        |              |                          +--rw user-id           string
        |              |                          +--rw (password-type)
        |              |                             +--:(cleartext-password)
        |              |                                +--rw cleartext-password?   string
        |              +--rw round-robin!
        |                 +--rw amount    uint16
        |                 +--rw units     enumeration
        +--rw bootstrap-servers
        |  +--rw bootstrap-server* [name]
        |     +--rw name                          string
        |     +--rw address                       ietf-inet-types:host
        |     +--rw port?                         ietf-inet-types:port-number <443>
        |     +--rw trust-anchor?                 ietf-crypto-types:trust-anchor-cert-cms
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw boot-images {wn-sztpd-0:onboarding-supported}?
        |  +--rw boot-image* [name]
        |     +--rw name                          string
        |     +--rw os-name?                      string
        |     +--rw os-version?                   string
        |     +--rw download-uri*                 ietf-inet-types:uri
        |     +--rw image-verification* [hash-algorithm]
        |     |  +--rw hash-algorithm    identityref
        |     |  +--rw hash-value        ietf-yang-types:hex-string
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw scripts {wn-sztpd-0:onboarding-supported}?
        |  +--rw pre-configuration-script* [name]
        |  |  +--rw name                          string
        |  |  +--rw script?                       ietf-sztp-conveyed-info:script
        |  |  +--ro reference-statistics
        |  |     +--ro reference-count    uint32
        |  |     +--ro last-referenced    union
        |  +--rw post-configuration-script* [name]
        |     +--rw name                          string
        |     +--rw script?                       ietf-sztp-conveyed-info:script
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw configurations {wn-sztpd-0:onboarding-supported}?
        |  +--rw configuration* [name]
        |     +--rw name                          string
        |     +--rw configuration-handling?       enumeration
        |     +--rw config?                       binary
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw conveyed-information-responses
        |  +--rw redirect-information-response* [name]
        |  |  +--rw name                          string
        |  |  +--rw redirect-information
        |  |  |  +--rw bootstrap-server*   -> ../../../../bootstrap-servers/bootstrap-server/name
        |  |  +--ro reference-statistics
        |  |     +--ro reference-count    uint32
        |  |     +--ro last-referenced    union
        |  +--rw onboarding-information-response* [name] {wn-sztpd-0:onboarding-supported}?
        |     +--rw name                          string
        |     +--rw onboarding-information
        |     |  +--rw boot-image                   -> ../../../../boot-images/boot-image/name
        |     |  +--rw pre-configuration-script?    -> ../../../../scripts/pre-configuration-script/name
        |     |  +--rw configuration?               -> ../../../../configurations/configuration/name
        |     |  +--rw post-configuration-script?   -> ../../../../scripts/post-configuration-script/name
        |     +--ro reference-statistics
        |        +--ro reference-count    uint32
        |        +--ro last-referenced    union
        +--rw devices
           +--rw device* [serial-number]
              +--rw serial-number                    string
              +--rw activation-code?                 iana-crypt-hash:crypt-hash
              +--rw response-manager
              |  +--rw matched-response* [name]
              |     +--rw name              string
              |     +--rw match-criteria!
              |     |  +--rw match* [key]
              |     |     +--rw key           string
              |     |     +--rw not?          empty
              |     |     +--rw (test-type)
              |     |        +--:(present)
              |     |        |  +--rw present?   empty
              |     |        +--:(value)
              |     |        |  +--rw value?   string
              |     |        +--:(regex)
              |     |           +--rw regex?   string
              |     +--rw response
              |        +--rw reporting-level?     enumeration <minimal> {wn-sztpd-0:onboarding-supported}?
              |        +--rw (response-handler)
              |           +--:(none)
              |           |  +--rw none?   empty
              |           +--:(managed-response)
              |              +--rw conveyed-information
              |                 +--rw (conveyed-information-handler)
              |                    +--:(use-dynamic-callout)
              |                    |  +--rw dynamic-callout
              |                    |     +--rw reference?   -> ../../../../../../../../dynamic-callouts/dyn\
amic-callout/name
              |                    +--:(redirect-information)
              |                    |  +--rw redirect-information
              |                    |     +--rw (local-or-reference)
              |                    |        +--:(reference)
              |                    |           +--rw reference?   -> ../../../../../../../../conveyed-infor\
mation-responses/redirect-information-response/name
              |                    +--:(onboarding-information) {wn-sztpd-0:onboarding-supported}?
              |                       +--rw onboarding-information
              |                          +--rw (local-or-reference)
              |                             +--:(reference)
              |                                +--rw reference?   -> ../../../../../../../../conveyed-infor\
mation-responses/onboarding-information-response/name
              +---n progress-report-received
                 +--ro progress-report?   anydata
              +--ro bootstrapping-log
              |  +--ro log-entry*
              |     +--ro timestamp         ietf-yang-types:date-and-time
              |     +--ro source-ip         ietf-inet-types:ip-address
              |     +--ro method            string
              |     +--ro path              string
              |     +--ro return-code       uint16
              |     +--ro error-returned?   anydata
              |     +--ro event-details
              |        +--ro (event-type)
              |           +--:(get-bootstrapping-data-event)
              |           |  +--ro get-bootstrapping-data-event
              |           |     +--ro passed-input
              |           |     |  +--ro (input-type)
              |           |     |     +--:(no-input-passed)
              |           |     |     |  +--ro no-input-passed?   empty
              |           |     |     +--:(input)
              |           |     |        +--ro input*
              |           |     |           +--ro key      string
              |           |     |           +--ro value    anydata
              |           |     +--ro selected-response?        union
              |           |     +--ro response-details
              |           |        +--ro (response-type)
              |           |           +--:(managed-response)
              |           |              +--ro managed-response
              |           |                 +--ro conveyed-information
              |           |                    +--ro (conveyed-information-handler)
              |           |                       +--:(dynamic-callout)
              |           |                       |  +--ro dynamic-callout
              |           |                       |     +--ro (result-type)?
              |           |                       |        +--:(no-callout-configured)
              |           |                       |        |  +--ro no-callout-configured?   empty
              |           |                       |        +--:(callout-configured)
              |           |                       |           +--ro name                     string
              |           |                       |           +--ro rpc-supported            identityref
              |           |                       |           +--ro callout-type             enumeration
              |           |                       |           +--ro (callback-or-webhook)?
              |           |                       |              +--:(callback)
              |           |                       |              |  +--ro callback-details
              |           |                       |              |  |  +--ro plugin      string
              |           |                       |              |  |  +--ro function    string
              |           |                       |              |  +--ro callback-results
              |           |                       |              |     +--ro (exit-status)
              |           |                       |              |        +--:(exception-thrown)
              |           |                       |              |        |  +--ro exception-thrown?   stri\
ng
              |           |                       |              |        +--:(exited-normally)
              |           |                       |              |           +--ro exited-normally?   string
              |           |                       |              +--:(webhook) {wn-app:webhook-based-callou\
ts}?
              |           |                       |                 +--ro webhook-details
              |           |                       |                 |  +--ro num-webhooks-configured    uin\
t8
              |           |                       |                 +--ro webhook-results
              |           |                       |                    +--ro webhook*
              |           |                       |                       +--ro name             string
              |           |                       |                       +--ro uri              ietf-inet-\
types:uri
              |           |                       |                       +--ro (result-type)?
              |           |                       |                          +--:(connection-error)
              |           |                       |                          |  +--ro connection-error?   s\
tring
              |           |                       |                          +--:(http-status-code)
              |           |                       |                             +--ro http-status-code    s\
tring
              |           |                       +--:(redirect-information)
              |           |                       |  +--ro redirect-information
              |           |                       |     +--ro (local-or-reference)
              |           |                       |        +--:(reference)
              |           |                       |           +--ro referenced-definition?   string
              |           |                       +--:(onboarding-information) {wn-sztpd-0:onboarding-suppo\
rted}?
              |           |                          +--ro onboarding-information
              |           |                             +--ro (local-or-reference)
              |           |                                +--:(reference)
              |           |                                   +--ro referenced-definition?   string
              |           +--:(report-progress-event) {wn-sztpd-0:onboarding-supported}?
              |              +--ro report-progress-event
              |                 +--ro passed-input
              |                 |  +--ro progress-type         string
              |                 |  +--ro message?              string
              |                 |  +--ro ssh-host-keys?        anydata
              |                 |  +--ro trust-anchor-certs?   anydata
              |                 +--ro dynamic-callout
              |                    +--ro (result-type)?
              |                       +--:(no-callout-configured)
              |                       |  +--ro no-callout-configured?   empty
              |                       +--:(callout-configured)
              |                          +--ro name                     string
              |                          +--ro rpc-supported            identityref
              |                          +--ro callout-type             enumeration
              |                          +--ro (callback-or-webhook)?
              |                             +--:(callback)
              |                             |  +--ro callback-details
              |                             |  |  +--ro plugin      string
              |                             |  |  +--ro function    string
              |                             |  +--ro callback-results
              |                             |     +--ro (exit-status)
              |                             |        +--:(exception-thrown)
              |                             |        |  +--ro exception-thrown?   string
              |                             |        +--:(exited-normally)
              |                             |           +--ro exited-normally?   string
              |                             +--:(webhook) {wn-app:webhook-based-callouts}?
              |                                +--ro webhook-details
              |                                |  +--ro num-webhooks-configured    uint8
              |                                +--ro webhook-results
              |                                   +--ro webhook*
              |                                      +--ro name             string
              |                                      +--ro uri              ietf-inet-types:uri
              |                                      +--ro (result-type)?
              |                                         +--:(connection-error)
              |                                         |  +--ro connection-error?   string
              |                                         +--:(http-status-code)
              |                                            +--ro http-status-code    string
              +--ro lifecycle-statistics
              |  +--ro nbi-access-stats
              |  |  +--ro created               ietf-yang-types:date-and-time
              |  |  +--ro num-times-modified    uint16
              |  |  +--ro last-modified         ietf-yang-types:date-and-time
              |  +--ro sbi-access-stats
              |     +--ro num-times-accessed    uint16
              |     +--ro first-accessed        ietf-yang-types:date-and-time
              |     +--ro last-accessed         ietf-yang-types:date-and-time
              +--rw device-type                      -> /device-types/device-type/name

6.4.1 XML-based Example

Request:

================================== NOTE: '\\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
cat << EOM > input.xml
<input xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
    <hw-model>model-x</hw-model>
    <os-name>vendor-os</os-name>
    <os-version>17.3R2.1</os-version>
    <nonce>extralongbase64encodedvalue=</nonce>
</input>
EOM

# POST 'input' for the "get-bootstrapping-data" RPC resource
curl -i -X POST --data @input.xml -H "Content-Type:application/yang-data+xml" --cacert sbi_trust_chain.pem \
\--key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-numb\
\er:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:get-bootstrapping-data \
\1> output/post_rpc_input_xml.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_rpc_input_xml.out

# cleanup
rm -f input.xml

Response:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

HTTP/1.1 200 OK
Content-Type: application/yang-data+xml; charset=utf-8
Content-Length: 2993
Date: Fri, 15 Jan 2021 02:38:09 GMT
Server: <redacted>

<?xml version="1.0" ?>
<output xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
  <conveyed-information>MIIITAYLKoZIhvcNAQkQASqgggg7BIIINzw/eG1sIHZlcnNpb249IjEuMCIgPz4KPGNvbnRlbnQtZGF0YSB\
4bWxucz0idXJuOmlldGY6cGFyYW1zOnhtbDpuczp5YW5nOmlldGYteWFuZy1pbnN0YW5jZS1kYXRhIj4KICA8cmVkaXJlY3QtaW5mb3JtYX\
Rpb24geG1sbnM9InVybjppZXRmOnBhcmFtczp4bWw6bnM6eWFuZzppZXRmLXN6dHAtY29udmV5ZWQtaW5mbyI+CiAgICA8Ym9vdHN0cmFwL\
XNlcnZlcj4KICAgICAgPGFkZHJlc3M+MTI3LjAuMC4xPC9hZGRyZXNzPgogICAgICA8cG9ydD45NDQzPC9wb3J0PgogICAgICA8dHJ1c3Qt\
YW5jaG9yPk1JSUZFUVlKS29aSWh2Y05BUWNDb0lJRkFqQ0NCUDRDQVFFeEFEQUxCZ2txaGtpRzl3MEJCd0dnZ2dUa01JSUNXakNDQWYrZ0F\
3SUJBZ0lCQVRBS0JnZ3Foa2pPUFFRREFqQjFNUXN3Q1FZRFZRUUdFd0pZV0RFZE1Cc0dBMVVFQ0F3VVRYa2dVM1JoZEdVZ2IzSWdVSEp2ZG\
1sdVkyVXhHREFXQmdOVkJBb01EMDE1SUU5eVoyRnVhWHBoZEdsdmJqRVFNQTRHQTFVRUN3d0hUWGtnVlc1cGRERWJNQmtHQTFVRUF3d1NjM\
kpwTDNObGNuWmxjaTl5YjI5MExXTmhNQ0FYRFRJd01Ea3hPREl3TVRrME5Gb1lEems1T1RreE1qTXhNak0xT1RVNVdqQjFNUXN3Q1FZRFZR\
UUdFd0pZV0RFZE1Cc0dBMVVFQ0F3VVRYa2dVM1JoZEdVZ2IzSWdVSEp2ZG1sdVkyVXhHREFXQmdOVkJBb01EMDE1SUU5eVoyRnVhWHBoZEd\
sdmJqRVFNQTRHQTFVRUN3d0hUWGtnVlc1cGRERWJNQmtHQTFVRUF3d1NjMkpwTDNObGNuWmxjaTl5YjI5MExXTmhNRmt3RXdZSEtvWkl6aj\
BDQVFZSUtvWkl6ajBEQVFjRFFnQUUwdURDOWRWTFpJTkluTit4SnRvR1prRk5lMVVPWFpNS0phVVdFYnVxaDNVTFowNXVnRUZkSFZnNVpJc\
0dwRllXRldlRTFPK0wycVBid1lGaUxXY1R6S04rTUh3d0hRWURWUjBPQkJZRUZLaGI5MkZWRFp6QkpwaEdjeUQvV1NBb1VYWVlNQXdHQTFV\
ZEV3UUZNQU1CQWY4d0RnWURWUjBQQVFIL0JBUURBZ0VHTUQwR0ExVWRId1EyTURRd01xQXdvQzZHTEdoMGRIQTZMeTlqY213dVpYaGhiWEJ\
zWlM1amIyMC9ZMkU5YzJKcE9uTmxjblpsY2pweWIyOTBMV05oTUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDSVFDWHQ4NENJelRjZTloS1p1WE\
dhSi9TMVA5WUxMbnE2dkQyWW5iOGh1RFJvQUloQUpFWjZqQWxiSmpjOVVQVlRHeURFaElnNmtzdmdZSDEvYnlJOXFacWxGdmZNSUlDZ2pDQ\
0FpaWdBd0lCQWdJQkFqQUtCZ2dxaGtqT1BRUURBakIxTVFzd0NRWURWUVFHRXdKWVdERWRNQnNHQTFVRUNBd1VUWGtnVTNSaGRHVWdiM0ln\
VUhKdmRtbHVZMlV4R0RBV0JnTlZCQW9NRDAxNUlFOXlaMkZ1YVhwaGRHbHZiakVRTUE0R0ExVUVDd3dIVFhrZ1ZXNXBkREViTUJrR0ExVUV\
Bd3dTYzJKcEwzTmxjblpsY2k5eWIyOTBMV05oTUNBWERUSXdNRGt4T0RJd01UazBOVm9ZRHprNU9Ua3hNak14TWpNMU9UVTVXakI3TVFzd0\
NRWURWUVFHRXdKWVdERWRNQnNHQTFVRUNBd1VUWGtnVTNSaGRHVWdiM0lnVUhKdmRtbHVZMlV4R0RBV0JnTlZCQW9NRDAxNUlFOXlaMkZ1Y\
VhwaGRHbHZiakVRTUE0R0ExVUVDd3dIVFhrZ1ZXNXBkREVoTUI4R0ExVUVBd3dZYzJKcEwzTmxjblpsY2k5cGJuUmxjbTFsWkdsaGRHVXhN\
Rmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUV3TzJVZkw5MVp6TWt5WS8xSW4vM2QxQzJHSDZMM3IxRFNQc2RETWFsbFJHSTJ\
TTFVBTTlxRGRDbmZXb01UcnZwbmJuZXZqOXFRdEdaU25vMHNHTFNiNk9Cb0RDQm5UQWRCZ05WSFE0RUZnUVVpRnNHVFZSc2ZNNElqaDRkRH\
pWbWdDTlJxT3N3SHdZRFZSMGpCQmd3Rm9BVXFGdjNZVlVObk1FbW1FWnpJUDlaSUNoUmRoZ3dEQVlEVlIwVEJBVXdBd0VCL3pBT0JnTlZIU\
ThCQWY4RUJBTUNBUVl3UFFZRFZSMGZCRFl3TkRBeW9EQ2dMb1lzYUhSMGNEb3ZMMk55YkM1bGVHRnRjR3hsTG1OdmJUOWpZVDF6WW1rNmMy\
VnlkbVZ5T25KdmIzUXRZMkV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloQU5sUFQxcHBEWjBwZXMyU2gvajJJZzRBVkNNakE1SkZsQ2JyVEJ\
qODBrZEpBaUFEQzVnRXhXM1hxb0ViekpNMDJsRFU3YkkyRmRrV09qVjZzRWppODE3dVg2RUFNUUE9PC90cnVzdC1hbmNob3I+CiAgICA8L2\
Jvb3RzdHJhcC1zZXJ2ZXI+CiAgPC9yZWRpcmVjdC1pbmZvcm1hdGlvbj4KPC9jb250ZW50LWRhdGE+Cg==</conveyed-information>
</output>

6.4.2 JSON-based Example

Request:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
cat << EOM > input.json
{ 
  "ietf-sztp-bootstrap-server:input" : {
    "hw-model" : "model-x",
    "os-name" : "vendor-os",
    "os-version" : "17.3R2.1",
    "nonce" : "extralongbase64encodedvalue="
  }
}
EOM

# POST 'input' for the "get-bootstrapping-data" RPC resource
curl -i -X POST --data @input.json -H "Content-Type:application/yang-data+json" --cacert sbi_trust_chain.pe\
m --key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-num\
ber:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:get-bootstrapping-data \
1> output/post_rpc_input.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_rpc_input.out

# cleanup
rm -f input.json

Response:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

HTTP/1.1 200 OK
Content-Type: application/yang-data+json; charset=utf-8
Content-Length: 2679
Date: Fri, 15 Jan 2021 02:38:09 GMT
Server: <redacted>

{
  "ietf-sztp-bootstrap-server:output": {
    "conveyed-information": "MIIHmQYLKoZIhvcNAQkQASugggeIBIIHhHsKICAiaWV0Zi1zenRwLWNvbnZleWVkLWluZm86cmVkaX\
JlY3QtaW5mb3JtYXRpb24iOiB7CiAgICAiYm9vdHN0cmFwLXNlcnZlciI6IFsKICAgICAgewogICAgICAgICJhZGRyZXNzIjogIjEyNy4wL\
jAuMSIsCiAgICAgICAgInBvcnQiOiA5NDQzLAogICAgICAgICJ0cnVzdC1hbmNob3IiOiAiTUlJRkVRWUpLb1pJaHZjTkFRY0NvSUlGQWpD\
Q0JQNENBUUV4QURBTEJna3Foa2lHOXcwQkJ3R2dnZ1RrTUlJQ1dqQ0NBZitnQXdJQkFnSUJBVEFLQmdncWhrak9QUVFEQWpCMU1Rc3dDUVl\
EVlFRR0V3SllXREVkTUJzR0ExVUVDQXdVVFhrZ1UzUmhkR1VnYjNJZ1VISnZkbWx1WTJVeEdEQVdCZ05WQkFvTUQwMTVJRTl5WjJGdWFYcG\
hkR2x2YmpFUU1BNEdBMVVFQ3d3SFRYa2dWVzVwZERFYk1Ca0dBMVVFQXd3U2MySnBMM05sY25abGNpOXliMjkwTFdOaE1DQVhEVEl3TURre\
E9ESXdNVGswTkZvWUR6azVPVGt4TWpNeE1qTTFPVFU1V2pCMU1Rc3dDUVlEVlFRR0V3SllXREVkTUJzR0ExVUVDQXdVVFhrZ1UzUmhkR1Vn\
YjNJZ1VISnZkbWx1WTJVeEdEQVdCZ05WQkFvTUQwMTVJRTl5WjJGdWFYcGhkR2x2YmpFUU1BNEdBMVVFQ3d3SFRYa2dWVzVwZERFYk1Ca0d\
BMVVFQXd3U2MySnBMM05sY25abGNpOXliMjkwTFdOaE1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTB1REM5ZFZMWklOSW\
5OK3hKdG9HWmtGTmUxVU9YWk1LSmFVV0VidXFoM1VMWjA1dWdFRmRIVmc1WklzR3BGWVdGV2VFMU8rTDJxUGJ3WUZpTFdjVHpLTitNSHd3S\
FFZRFZSME9CQllFRktoYjkyRlZEWnpCSnBoR2N5RC9XU0FvVVhZWU1Bd0dBMVVkRXdRRk1BTUJBZjh3RGdZRFZSMFBBUUgvQkFRREFnRUdN\
RDBHQTFVZEh3UTJNRFF3TXFBd29DNkdMR2gwZEhBNkx5OWpjbXd1WlhoaGJYQnNaUzVqYjIwL1kyRTljMkpwT25ObGNuWmxjanB5YjI5MEx\
XTmhNQW9HQ0NxR1NNNDlCQU1DQTBrQU1FWUNJUUNYdDg0Q0l6VGNlOWhLWnVYR2FKL1MxUDlZTExucTZ2RDJZbmI4aHVEUm9BSWhBSkVaNm\
pBbGJKamM5VVBWVEd5REVoSWc2a3N2Z1lIMS9ieUk5cVpxbEZ2Zk1JSUNnakNDQWlpZ0F3SUJBZ0lCQWpBS0JnZ3Foa2pPUFFRREFqQjFNU\
XN3Q1FZRFZRUUdFd0pZV0RFZE1Cc0dBMVVFQ0F3VVRYa2dVM1JoZEdVZ2IzSWdVSEp2ZG1sdVkyVXhHREFXQmdOVkJBb01EMDE1SUU5eVoy\
RnVhWHBoZEdsdmJqRVFNQTRHQTFVRUN3d0hUWGtnVlc1cGRERWJNQmtHQTFVRUF3d1NjMkpwTDNObGNuWmxjaTl5YjI5MExXTmhNQ0FYRFR\
Jd01Ea3hPREl3TVRrME5Wb1lEems1T1RreE1qTXhNak0xT1RVNVdqQjdNUXN3Q1FZRFZRUUdFd0pZV0RFZE1Cc0dBMVVFQ0F3VVRYa2dVM1\
JoZEdVZ2IzSWdVSEp2ZG1sdVkyVXhHREFXQmdOVkJBb01EMDE1SUU5eVoyRnVhWHBoZEdsdmJqRVFNQTRHQTFVRUN3d0hUWGtnVlc1cGRER\
WhNQjhHQTFVRUF3d1ljMkpwTDNObGNuWmxjaTlwYm5SbGNtMWxaR2xoZEdVeE1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdB\
RXdPMlVmTDkxWnpNa3lZLzFJbi8zZDFDMkdINkwzcjFEU1BzZERNYWxsUkdJMlNMVUFNOXFEZENuZldvTVRydnBuYm5ldmo5cVF0R1pTbm8\
wc0dMU2I2T0JvRENCblRBZEJnTlZIUTRFRmdRVWlGc0dUVlJzZk00SWpoNGREelZtZ0NOUnFPc3dId1lEVlIwakJCZ3dGb0FVcUZ2M1lWVU\
5uTUVtbUVaeklQOVpJQ2hSZGhnd0RBWURWUjBUQkFVd0F3RUIvekFPQmdOVkhROEJBZjhFQkFNQ0FRWXdQUVlEVlIwZkJEWXdOREF5b0RDZ\
0xvWXNhSFIwY0RvdkwyTnliQzVsZUdGdGNHeGxMbU52YlQ5allUMXpZbWs2YzJWeWRtVnlPbkp2YjNRdFkyRXdDZ1lJS29aSXpqMEVBd0lE\
U0FBd1JRSWhBTmxQVDFwcERaMHBlczJTaC9qMklnNEFWQ01qQTVKRmxDYnJUQmo4MGtkSkFpQURDNWdFeFczWHFvRWJ6Sk0wMmxEVTdiSTJ\
GZGtXT2pWNnNFamk4MTd1WDZFQU1RQT0iCiAgICAgIH0KICAgIF0KICB9Cn0="
  }
}

6.5.1 XML-based Example

Request:

================================== NOTE: '\\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
cat << EOM > input.xml
<input xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
    <hw-model>model-x</hw-model>
    <os-name>vendor-os</os-name>
    <os-version>17.3R2.1</os-version>
    <nonce>extralongbase64encodedvalue=</nonce>
</input>
EOM

# POST 'input' for the "get-bootstrapping-data" RPC resource
curl -i -X POST --data @input.xml -H "Content-Type:application/yang-data+xml" --cacert sbi_trust_chain.pem \
\--key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-numb\
\er:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:get-bootstrapping-data \
\1> output/post_rpc_input_xml.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_rpc_input_xml.out

# cleanup
rm -f input.xml

Response:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

HTTP/1.1 200 OK
Content-Type: application/yang-data+xml; charset=utf-8
Content-Length: 1605
Date: Fri, 15 Jan 2021 02:38:11 GMT
Server: <redacted>

<?xml version="1.0" ?>
<output xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
  <conveyed-information>MIIEPAYLKoZIhvcNAQkQASqgggQrBIIEJzw/eG1sIHZlcnNpb249IjEuMCIgPz4KPGNvbnRlbnQtZGF0YSB\
4bWxucz0idXJuOmlldGY6cGFyYW1zOnhtbDpuczp5YW5nOmlldGYteWFuZy1pbnN0YW5jZS1kYXRhIj4KICA8b25ib2FyZGluZy1pbmZvcm\
1hdGlvbiB4bWxucz0idXJuOmlldGY6cGFyYW1zOnhtbDpuczp5YW5nOmlldGYtc3p0cC1jb252ZXllZC1pbmZvIj4KICAgIDxib290LWltY\
WdlPgogICAgICA8ZG93bmxvYWQtdXJpPmh0dHBzOi8vZXhhbXBsZS5jb20vbXktYm9vdC1pbWFnZS5pbWc8L2Rvd25sb2FkLXVyaT4KICAg\
ICAgPGltYWdlLXZlcmlmaWNhdGlvbj4KICAgICAgICA8aGFzaC1hbGdvcml0aG0+aWV0Zi1zenRwLWNvbnZleWVkLWluZm86c2hhLTI1Njw\
vaGFzaC1hbGdvcml0aG0+CiAgICAgICAgPGhhc2gtdmFsdWU+NmY6ODc6MGI6YWY6M2M6M2E6ZmU6MDM6MTQ6NTc6MjQ6Mjc6YzY6YmE6ND\
k6MDQ6Yjk6NTI6OTQ6NDM6OGQ6Yjg6N2I6MjE6YjM6YTk6MjQ6OTI6MzE6MmM6MDA6ZDk8L2hhc2gtdmFsdWU+CiAgICAgIDwvaW1hZ2Utd\
mVyaWZpY2F0aW9uPgogICAgPC9ib290LWltYWdlPgogICAgPHByZS1jb25maWd1cmF0aW9uLXNjcmlwdD5JeTlpYVc0dlltRnphQXBsWTJo\
dklDSnBibk5wWkdVZ2RHaGxJSEJ5WlMxamIyNW1hV2QxY21GMGFXOXVMWE5qY21sd2RDNHVMaUlLPC9wcmUtY29uZmlndXJhdGlvbi1zY3J\
pcHQ+CiAgICA8Y29uZmlndXJhdGlvbi1oYW5kbGluZz5tZXJnZTwvY29uZmlndXJhdGlvbi1oYW5kbGluZz4KICAgIDxjb25maWd1cmF0aW\
9uPlBIUnZjQ0I0Yld4dWN6MGlhSFIwY0hNNkwyVjRZVzF3YkdVdVkyOXRMMk52Ym1acFp5SStDaUFnUEdGdWVTMTRiV3d0WTI5dWRHVnVkQ\
zF2YTJGNUx6NEtQQzkwYjNBK0NnPT08L2NvbmZpZ3VyYXRpb24+CiAgICA8cG9zdC1jb25maWd1cmF0aW9uLXNjcmlwdD5JeTlpYVc0dllt\
RnphQXBsWTJodklDSnBibk5wWkdVZ2RHaGxJSEJ2YzNRdFkyOXVabWxuZFhKaGRHbHZiaTF6WTNKcGNIUXVMaTRpQ2c9PTwvcG9zdC1jb25\
maWd1cmF0aW9uLXNjcmlwdD4KICA8L29uYm9hcmRpbmctaW5mb3JtYXRpb24+CjwvY29udGVudC1kYXRhPgo=</conveyed-information>
</output>

6.5.2 JSON-based Example

Request:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
cat << EOM > input.json
{ 
  "ietf-sztp-bootstrap-server:input" : {
    "hw-model" : "model-x",
    "os-name" : "vendor-os",
    "os-version" : "17.3R2.1",
    "nonce" : "extralongbase64encodedvalue="
  }
}
EOM

# POST 'input' for the "get-bootstrapping-data" RPC resource
curl -i -X POST --data @input.json -H "Content-Type:application/yang-data+json" --cacert sbi_trust_chain.pe\
m --key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-num\
ber:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:get-bootstrapping-data \
1> output/post_rpc_input.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_rpc_input.out

# cleanup
rm -f input.json

Response:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

HTTP/1.1 200 OK
Content-Type: application/yang-data+json; charset=utf-8
Content-Length: 1187
Date: Fri, 15 Jan 2021 02:38:10 GMT
Server: <redacted>

{
  "ietf-sztp-bootstrap-server:output": {
    "conveyed-information": "MIIDOQYLKoZIhvcNAQkQASugggMoBIIDJHsKICAiaWV0Zi1zenRwLWNvbnZleWVkLWluZm86b25ib2\
FyZGluZy1pbmZvcm1hdGlvbiI6IHsKICAgICJib290LWltYWdlIjogewogICAgICAiZG93bmxvYWQtdXJpIjogWwogICAgICAgICJodHRwc\
zovL2V4YW1wbGUuY29tL215LWJvb3QtaW1hZ2UuaW1nIgogICAgICBdLAogICAgICAiaW1hZ2UtdmVyaWZpY2F0aW9uIjogWwogICAgICAg\
IHsKICAgICAgICAgICJoYXNoLWFsZ29yaXRobSI6ICJpZXRmLXN6dHAtY29udmV5ZWQtaW5mbzpzaGEtMjU2IiwKICAgICAgICAgICJoYXN\
oLXZhbHVlIjogIjZmOjg3OjBiOmFmOjNjOjNhOmZlOjAzOjE0OjU3OjI0OjI3OmM2OmJhOjQ5OjA0OmI5OjUyOjk0OjQzOjhkOmI4OjdiOj\
IxOmIzOmE5OjI0OjkyOjMxOjJjOjAwOmQ5IgogICAgICAgIH0KICAgICAgXQogICAgfSwKICAgICJwcmUtY29uZmlndXJhdGlvbi1zY3Jpc\
HQiOiAiSXk5aWFXNHZZbUZ6YUFwbFkyaHZJQ0pwYm5OcFpHVWdkR2hsSUhCeVpTMWpiMjVtYVdkMWNtRjBhVzl1TFhOamNtbHdkQzR1TGlJ\
SyIsCiAgICAiY29uZmlndXJhdGlvbi1oYW5kbGluZyI6ICJtZXJnZSIsCiAgICAiY29uZmlndXJhdGlvbiI6ICJQSFJ2Y0NCNGJXeHVjejB\
pYUhSMGNITTZMMlY0WVcxd2JHVXVZMjl0TDJOdmJtWnBaeUkrQ2lBZ1BHRnVlUzE0Yld3dFkyOXVkR1Z1ZEMxdmEyRjVMejRLUEM5MGIzQS\
tDZz09IiwKICAgICJwb3N0LWNvbmZpZ3VyYXRpb24tc2NyaXB0IjogIkl5OWlhVzR2WW1GemFBcGxZMmh2SUNKcGJuTnBaR1VnZEdobElIQ\
nZjM1F0WTI5dVptbG5kWEpoZEdsdmJpMXpZM0pwY0hRdUxpNGlDZz09IgogIH0KfQ=="
  }
}

6.6.1 XML-based Example

Request:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
cat << EOM > input.xml
<input xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
  <progress-type>bootstrap-complete</progress-type>
  <message>example message</message>
  <ssh-host-keys>
    <ssh-host-key>
      <algorithm>ssh-rsa</algorithm>
      <key-data>base64encodedvalue==</key-data>
    </ssh-host-key>
    <ssh-host-key>
      <algorithm>rsa-sha2-256</algorithm>
      <key-data>base64encodedvalue==</key-data>
    </ssh-host-key>
  </ssh-host-keys>
  <trust-anchor-certs>
    <trust-anchor-cert>base64encodedvalue==</trust-anchor-cert>
  </trust-anchor-certs>
</input>
EOM

# POST it to the "report-progress" RPC resource
curl -i -X POST --data @input.xml -H "Content-Type:application/yang-data+xml" --cacert sbi_trust_chain.pem \
--key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-numbe\
r:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:report-progress 1> output\
/post_progress_report_xml.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_progress_report_xml.out

# cleanup
rm -f input.xml

Response:

HTTP/1.1 204 No Content
Content-Type: application/octet-stream
Date: Fri, 15 Jan 2021 02:38:12 GMT
Server: <redacted>

6.6.2 JSON-based Example

Request:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
  cat << EOM > bootstrap-complete.json
{
  "ietf-sztp-bootstrap-server:input" : {
    "progress-type" : "bootstrap-complete",
    "message" : "Dynamically generated SSH host key included.",
    "ssh-host-keys" : {
      "ssh-host-key" : [
        {
          "algorithm" : "ssh-rsa",
          "key-data" : "base64encodedvalue=="
        }
      ]
    }
  }
}
EOM

# POST it to the "report-progress" RPC resource
curl -i -X POST --data @bootstrap-complete.json -H "Content-Type:application/yang-data+json" --cacert sbi_t\
rust_chain.pem --key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user \
my-serial-number:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:report-pro\
gress 1> output/post_progress_report.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_progress_report.out

# cleanup
rm -f bootstrap-complete.json

Response:

HTTP/1.1 204 No Content
Content-Type: application/octet-stream
Date: Fri, 15 Jan 2021 02:38:11 GMT
Server: <redacted>

6.7.1 XML-based Example

Request:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
cat << EOM > input.xml
<input xmlns="urn:ietf:params:xml:ns:yang:ietf-sztp-bootstrap-server">
  <foo-bar>bootstrap-initiated</foo-bar>
</input>
EOM

# POST it to the "report-progress" RPC resource
curl -i -X POST --data @input.xml -H "Content-Type:application/yang-data+xml" --cacert sbi_trust_chain.pem \
--key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-numbe\
r:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:report-progress 1> output\
/post_progress_report_error_xml.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_progress_report_error_xml.out

# cleanup
rm -f input.xml

Response:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

HTTP/1.1 400 Bad Request
Content-Type: application/yang-data+xml; charset=utf-8
Content-Length: 417
Date: Fri, 15 Jan 2021 02:38:12 GMT
Server: <redacted>

<?xml version="1.0" ?>
<content-data xmlns="urn:ietf:params:xml:ns:yang:ietf-yang-instance-data">
  <errors xmlns="urn:ietf:params:xml:ns:yang:ietf-restconf">
    <error>
      <error-type>protocol</error-type>
      <error-tag>malformed-message</error-tag>
      <error-message>Unable to parse &quot;input&quot; document: Doesn't match schema: /input/foo-bar</erro\
r-message>
    </error>
  </errors>
</content-data>

6.7.2 JSON-based Example

Request:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

#!/bin/sh 

# initialize the 'input' node for the RPC
  cat << EOM > input.json
{
  "ietf-sztp-bootstrap-server:input" : {
    "foo-bar" : "bootstrap-initiated"
  }
}
EOM

# POST it to the "report-progress" RPC resource
curl -i -X POST --data @input.json -H "Content-Type:application/yang-data+json" --cacert sbi_trust_chain.pe\
m --key pki/client/end-entity/private_key.pem --cert pki/client/end-entity/my_cert.pem --user my-serial-num\
ber:my-secret https://127.0.0.1:9090/restconf/operations/ietf-sztp-bootstrap-server:report-progress 1> outp\
ut/post_progress_report_error.out 2>/dev/null

# line-return needed for markdown
echo "" 1>> output/post_progress_report_error.out

# cleanup
rm -f input.json

Response:

=================================== NOTE: '\' line wrapping per RFC 8792 ===================================

HTTP/1.1 400 Bad Request
Content-Type: application/yang-data+json; charset=utf-8
Content-Length: 275
Date: Fri, 15 Jan 2021 02:38:12 GMT
Server: <redacted>

{
  "ietf-restconf:errors": {
    "error": [
      {
        "error-type": "protocol",
        "error-tag": "malformed-message",
        "error-message": "Unable to parse \"input\" document: Doesn't match schema: /ietf-sztp-bootstrap-se\
rver:input/foo-bar"
      }
    ]
  }
}

7.1.1 TLS Terminator

7.2.1 RDBMS

SZTPD may be configured to reach out to an external RDBMS server for its database. The protocol used for this connection is database-specific, and may be shroudable by a TLS session (recommended).

7.2.2 Dynamic Callouts

Dynamic callouts may either be implemented as a plugin loaded into SZTPD, or as a webhook (an HTTP “POST” request) to an external peering system.

  rpcs:
    +---x relay-notification {relay-notification}?
       +---- input
          +---w notification?   anydata

POST /restconf/operations/wn-app-rpcs:relay-notification HTTP/1.1
HOST: example.com
Content-Type: application/yang.data+json

{
  "wn-app-rpcs:input" : {
    "notification": {
      "eventTime": "2019-03|22T12:35:00Z",
      "wn-sztpd-1:unused-device-record-lingering": {
        "device-record": "fault",
        "created": "20190122T10:32:12Z",
        "num-times-modified": 3,
        "last-modified": "20190320T09:51:44Z"
      }
    }
  }
}

HTTP/1.1 204 OK
Date: Sat, 31 Oct 2015 17:02:40 GMT
Server: example-server
Content-Type: application/yang.data+json

  rpcs:
    +---x verify-device-ownership {verify-device-ownership}?
       +---- input
       |  +---w tenant           string
       |  +---w serial-number*   string
       +---- output
          +--ro verification-results
             +--ro verification-result* [serial-number]
                +--ro serial-number    string
                +--ro result           enumeration

POST /restconf/operations/wn-sztpd-rpcs:verify-device-ownership HTTP/1.1
HOST: example.com
Content-Type: application/yang.data+json

{
  "wn-sztpd-rpcs:input" : {
    "tenant": "not-applicable",
    "serial-number": [ "sn-111", "sn-222", "sn-333" ]
  }
}

HTTP/1.1 200 OK
Date: Sat, 31 Oct 2015 17:02:40 GMT
Server: example-server
Content-Type: application/yang.data+json

{
  "ietf-sztpd-rpcs:output" : {
    "verification-results": {
      "verification-result": [
        {
          "serial-number": "sn-111",
          "result": "success"
        },
        {
          "serial-number": "sn-222",
          "result": "failure"
        },
        {
          "serial-number": "sn-333",
          "result": "success"
        }
      ]
    }
  }
}

  rpcs:
    +---x get-conveyed-information {get-conveyed-information}?
       +---- input
       |  +---w serial-number           string
       |  +---w source-ip-address       ietf-inet-types:ip-address
       |  +---w from-device?            anydata
       |  +---w identity-certificate?   ietf-crypto-types:cms
       +---- output
          +--ro conveyed-information    anydata

POST /restconf/operations/wn-sztpd-rpcs:get-conveyed-information HTTP/1.1
HOST: example.com
Content-Type: application/yang.data+json

{
  "wn-sztpd-rpcs:input" : {
    "serial-number": "my-serial-number",
    "source-ip-address": "10.20.30.40",
    "from-device": {
      "ietf-sztp-bootstrap-server:input" : {
        "hw-model": "model-x",
        "os-name": "vendor-os",
        "os-version": "17.3R2.1",
        "nonce": "extralongbase64encodedvalue=",
        "ietf-sztp-csr:csr": {
          "p10": "base64encodedvalue=="
        }
      }
    },
    "identity-certificate": "base64encodedvalue=="
  }
}

HTTP/1.1 200 OK
Date: Sat, 31 Oct 2015 17:02:40 GMT
Server: example-server
Content-Type: application/yang.data+json

{
  "ietf-sztpd-rpcs:output" : {
    "conveyed-information": "base64encodedvalue=="
  }
}

7.2.3 Notifications

The following “notification” statements are defined in the “wn-app-rpcs” YANG module:

notifications
  +-- unreferenced-node-lingering
  +-- unreferenced-node-purged
  +-- admin-account-activation-expired
  +-- admin-account-password-aging
  +-- admin-account-disabled
  +-- admin-account-purged
  +-- audit-log-entry-purged

The following “notification” statements are defined in the “wn-sztpd-0” YANG module, which is used as a basis for all the SZTPD YANG modules (mode ‘1’ and mode ‘x’ models):

notifications
  +-- voucher-expiration
  +-- unused-device-record-lingering
  +-- unused-device-record-purged
  +-- used-device-record-lingering
  +-- used-device-record-purged
  +-- progress-report-received

The following “notification” statement is defined in the “ietf-crypto-types” YANG module:

notifications
  +-- certificate-expiration

The following “notification” statements are defined in the “ietf-yang-library” YANG module:

notifications
  +-- yang-library-update
  +-- yang-library-change

Similarly, per RFC 8572, SZTPD uses notifications to relay “progress-reports” to integrating applications.

+---n unreferenced-node-lingering {wn-app:storage-reclamation-implemented}?
   +--ro last-referenced    union

+---n unreferenced-node-purged {wn-app:storage-reclamation-implemented}?
   +--ro last-referenced    union

+---n admin-account-activation-expired {wn-app:account-activation-expiration-implemented}?

+---n admin-account-password-aging {wn-app:password-aging-implemented}?
   +--ro expiration-date    ietf-yang-types:date-and-time

+---n admin-account-disabled {wn-app:storage-reclamation-implemented}?

+---n admin-account-purged {wn-app:storage-reclamation-implemented}?

+---n voucher-expiration
   +--ro expiration-date    ietf-yang-types:date-and-time

+---n unused-device-record-lingering {wn-app:storage-reclamation-implemented}?
   +--ro nbi-access-stats
      +--ro created               ietf-yang-types:date-and-time
      +--ro num-times-modified    uint16
      +--ro last-modified         ietf-yang-types:date-and-time

+---n unused-device-record-purged {wn-app:storage-reclamation-implemented}?
   +--ro nbi-access-stats
      +--ro created               ietf-yang-types:date-and-time
      +--ro num-times-modified    uint16
      +--ro last-modified         ietf-yang-types:date-and-time

+---n used-device-record-lingering {wn-app:storage-reclamation-implemented}?
   +--ro nbi-access-stats
   |  +--ro created               ietf-yang-types:date-and-time
   |  +--ro num-times-modified    uint16
   |  +--ro last-modified         ietf-yang-types:date-and-time
   +--ro sbi-access-stats
      +--ro num-times-accessed    uint16
      +--ro first-accessed        ietf-yang-types:date-and-time
      +--ro last-accessed         ietf-yang-types:date-and-time

+---n used-device-record-purged {wn-app:storage-reclamation-implemented}?
   +--ro nbi-access-stats
   |  +--ro created               ietf-yang-types:date-and-time
   |  +--ro num-times-modified    uint16
   |  +--ro last-modified         ietf-yang-types:date-and-time
   +--ro sbi-access-stats
      +--ro num-times-accessed    uint16
      +--ro first-accessed        ietf-yang-types:date-and-time
      +--ro last-accessed         ietf-yang-types:date-and-time

+---n certificate-expiration {ietf-crypto-types:certificate-expiration-notification}?
   +--ro expiration-date    ietf-yang-types:date-and-time

x---n yang-library-change
   x--ro module-set-id    -> /ietf-yang-library:modules-state/ietf-yang-library:module-set-id

+---n yang-library-update
   +--ro content-id    -> /ietf-yang-library:yang-library/ietf-yang-library:content-id

x---n yang-library-change
   x--ro module-set-id    -> /ietf-yang-library:modules-state/ietf-yang-library:module-set-id