# coding=utf-8
# *** WARNING: this file was generated by pulumi-language-python. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import builtins as _builtins
import warnings
import sys
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
if sys.version_info >= (3, 11):
    from typing import NotRequired, TypedDict, TypeAlias
else:
    from typing_extensions import NotRequired, TypedDict, TypeAlias
from .. import _utilities

__all__ = [
    'GetServerKeysResult',
    'AwaitableGetServerKeysResult',
    'get_server_keys',
    'get_server_keys_output',
]

@pulumi.output_type
class GetServerKeysResult:
    """
    A collection of values returned by getServerKeys.
    """
    def __init__(__self__, alg=None, auth_server_id=None, e=None, id=None, key_id=None, kid=None, n=None, status=None, use=None):
        if alg and not isinstance(alg, str):
            raise TypeError("Expected argument 'alg' to be a str")
        pulumi.set(__self__, "alg", alg)
        if auth_server_id and not isinstance(auth_server_id, str):
            raise TypeError("Expected argument 'auth_server_id' to be a str")
        pulumi.set(__self__, "auth_server_id", auth_server_id)
        if e and not isinstance(e, str):
            raise TypeError("Expected argument 'e' to be a str")
        pulumi.set(__self__, "e", e)
        if id and not isinstance(id, str):
            raise TypeError("Expected argument 'id' to be a str")
        pulumi.set(__self__, "id", id)
        if key_id and not isinstance(key_id, str):
            raise TypeError("Expected argument 'key_id' to be a str")
        pulumi.set(__self__, "key_id", key_id)
        if kid and not isinstance(kid, str):
            raise TypeError("Expected argument 'kid' to be a str")
        pulumi.set(__self__, "kid", kid)
        if n and not isinstance(n, str):
            raise TypeError("Expected argument 'n' to be a str")
        pulumi.set(__self__, "n", n)
        if status and not isinstance(status, str):
            raise TypeError("Expected argument 'status' to be a str")
        pulumi.set(__self__, "status", status)
        if use and not isinstance(use, str):
            raise TypeError("Expected argument 'use' to be a str")
        pulumi.set(__self__, "use", use)

    @_builtins.property
    @pulumi.getter
    def alg(self) -> _builtins.str:
        """
        The algorithm used with the Key. Typically "RS256" for RSA keys.
        """
        return pulumi.get(self, "alg")

    @_builtins.property
    @pulumi.getter(name="authServerId")
    def auth_server_id(self) -> _builtins.str:
        """
        The ID of the authorization server.
        """
        return pulumi.get(self, "auth_server_id")

    @_builtins.property
    @pulumi.getter
    def e(self) -> _builtins.str:
        """
        RSA key value (public exponent) for Key binding. Typically "AQAB".
        """
        return pulumi.get(self, "e")

    @_builtins.property
    @pulumi.getter
    def id(self) -> _builtins.str:
        return pulumi.get(self, "id")

    @_builtins.property
    @pulumi.getter(name="keyId")
    def key_id(self) -> _builtins.str:
        """
        The ID of the certificate key.
        """
        return pulumi.get(self, "key_id")

    @_builtins.property
    @pulumi.getter
    def kid(self) -> _builtins.str:
        """
        Unique identifier for the key (Key ID).
        """
        return pulumi.get(self, "kid")

    @_builtins.property
    @pulumi.getter
    def n(self) -> _builtins.str:
        """
        RSA modulus value that is used by both the public and private keys and provides a link between them.
        """
        return pulumi.get(self, "n")

    @_builtins.property
    @pulumi.getter
    def status(self) -> _builtins.str:
        """
        The status of the key. An ACTIVE key is used to sign tokens issued by the authorization server. Supported values: `ACTIVE`, `NEXT`, or `EXPIRED`. A NEXT key is the next key that the authorization server uses to sign tokens when keys are rotated. The NEXT key might not be listed if it hasn't been generated. An EXPIRED key is the previous key that the authorization server used to sign tokens. The EXPIRED key might not be listed if no key has expired or the expired key was deleted.
        """
        return pulumi.get(self, "status")

    @_builtins.property
    @pulumi.getter
    def use(self) -> _builtins.str:
        """
        Acceptable use of the key. Typically "sig" for signature operations.
        """
        return pulumi.get(self, "use")


class AwaitableGetServerKeysResult(GetServerKeysResult):
    # pylint: disable=using-constant-test
    def __await__(self):
        if False:
            yield self
        return GetServerKeysResult(
            alg=self.alg,
            auth_server_id=self.auth_server_id,
            e=self.e,
            id=self.id,
            key_id=self.key_id,
            kid=self.kid,
            n=self.n,
            status=self.status,
            use=self.use)


def get_server_keys(auth_server_id: Optional[_builtins.str] = None,
                    key_id: Optional[_builtins.str] = None,
                    opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetServerKeysResult:
    """
    Get a specific authorization server credential key from Okta. Authorization server keys are JSON Web Keys (JWK) used for signing tokens issued by the authorization server.

    This data source allows you to retrieve information about a specific key used by an authorization server for token signing operations.

    ## Example Usage

    ```python
    import pulumi
    import pulumi_okta as okta

    example = okta.auth.get_server_keys(auth_server_id="aus123456789abcdefgh",
        key_id="abcdefghijk0123456789")
    ```

    ## Notes

    - To find available key IDs for an authorization server, you can use the Okta Admin Console or make a direct API call to `/api/v1/authorizationServers/{authServerId}/credentials/keys`
    - The key ID (`kid`) is automatically generated by Okta and is unique within the authorization server
    - This data source is useful for retrieving key information for verification purposes or to reference in other configurations


    :param _builtins.str auth_server_id: The ID of the authorization server.
    :param _builtins.str key_id: The ID of the certificate key.
    """
    __args__ = dict()
    __args__['authServerId'] = auth_server_id
    __args__['keyId'] = key_id
    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke('okta:auth/getServerKeys:getServerKeys', __args__, opts=opts, typ=GetServerKeysResult).value

    return AwaitableGetServerKeysResult(
        alg=pulumi.get(__ret__, 'alg'),
        auth_server_id=pulumi.get(__ret__, 'auth_server_id'),
        e=pulumi.get(__ret__, 'e'),
        id=pulumi.get(__ret__, 'id'),
        key_id=pulumi.get(__ret__, 'key_id'),
        kid=pulumi.get(__ret__, 'kid'),
        n=pulumi.get(__ret__, 'n'),
        status=pulumi.get(__ret__, 'status'),
        use=pulumi.get(__ret__, 'use'))
def get_server_keys_output(auth_server_id: Optional[pulumi.Input[_builtins.str]] = None,
                           key_id: Optional[pulumi.Input[_builtins.str]] = None,
                           opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetServerKeysResult]:
    """
    Get a specific authorization server credential key from Okta. Authorization server keys are JSON Web Keys (JWK) used for signing tokens issued by the authorization server.

    This data source allows you to retrieve information about a specific key used by an authorization server for token signing operations.

    ## Example Usage

    ```python
    import pulumi
    import pulumi_okta as okta

    example = okta.auth.get_server_keys(auth_server_id="aus123456789abcdefgh",
        key_id="abcdefghijk0123456789")
    ```

    ## Notes

    - To find available key IDs for an authorization server, you can use the Okta Admin Console or make a direct API call to `/api/v1/authorizationServers/{authServerId}/credentials/keys`
    - The key ID (`kid`) is automatically generated by Okta and is unique within the authorization server
    - This data source is useful for retrieving key information for verification purposes or to reference in other configurations


    :param _builtins.str auth_server_id: The ID of the authorization server.
    :param _builtins.str key_id: The ID of the certificate key.
    """
    __args__ = dict()
    __args__['authServerId'] = auth_server_id
    __args__['keyId'] = key_id
    opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
    __ret__ = pulumi.runtime.invoke_output('okta:auth/getServerKeys:getServerKeys', __args__, opts=opts, typ=GetServerKeysResult)
    return __ret__.apply(lambda __response__: GetServerKeysResult(
        alg=pulumi.get(__response__, 'alg'),
        auth_server_id=pulumi.get(__response__, 'auth_server_id'),
        e=pulumi.get(__response__, 'e'),
        id=pulumi.get(__response__, 'id'),
        key_id=pulumi.get(__response__, 'key_id'),
        kid=pulumi.get(__response__, 'kid'),
        n=pulumi.get(__response__, 'n'),
        status=pulumi.get(__response__, 'status'),
        use=pulumi.get(__response__, 'use')))
