REST API: /v2/certificate/search

[tlull]

Hello,
we are using EJBCA 8.2.0.1 Community. I try to find active certificates by using /v2/certificate/search.
The parameter "criteria" is a list of search criteria as the documentation says.
But it is not clear whether the criteria are combined by "and" or "or".
There is no information about that in the documentation.
In my opinion it is "or".
If this is correct, is there a way to combine expressions by "and"?

Kind regards,
Torsten

[dobicinaitis]

Hi! Criteria are combined using AND. Try searching for all active certificates:

{
  "pagination": {
    "page_size": 10,
    "current_page": 1
  },
  "sort": {
    "property": "USERNAME",
    "operation": "ASC"
  },
  "criteria": [
    {
      "property": "STATUS",
      "value": "CERT_ACTIVE",
      "operation": "EQUAL"
    }
  ]
}

Then add another criteria to narrow down the search results:

{
  "pagination": {
    "page_size": 10,
    "current_page": 1
  },
  "sort": {
    "property": "USERNAME",
    "operation": "ASC"
  },
  "criteria": [
    {
      "property": "STATUS",
      "value": "CERT_ACTIVE",
      "operation": "EQUAL"
    },
    {
      "property": "END_ENTITY_PROFILE",
      "value": "EMPTY",
      "operation": "EQUAL"
    }
  ]
}

The result should now contain only entries matching both criteria.

[tlull]

Hello,
thanks for your answer. But in my opinion the criteria are combined by "or".
In example, when I compose the creteria in the following way:

criteria   = @(
      @{
         property  = "CERTIFICATE_PROFILE"
         operation = "EQUAL"
         value     = "prof1"
      },
      @{
         property  = "CERTIFICATE_PROFILE"
         operation = "EQUAL"
         value     = "prof2"
      }
   )

then I still get results. But the result should be empty, because the are no certificates that belong to 2 certificate profiles at the same time.
How can I define, whether the expressions are combined by "or" or "and"?

Kind regards,
Torsten

[dobicinaitis]

Ah, I see your dilemma now. When the same criteria is used multiple times, it indeed does not create an AND condition. In SQL terms, the values for the same criteria are combined using an IN clause, which returns entries that match any of the specified certificate profiles.
Unfortunately, the REST API currently does not provide a way to exclude entries that do not meet both criterias of the same type.

[tlull]

Thanks for your explanation, that helps me a lot to understand what's goning on.
In conclusion:

• The same conditions are treated as or combined.
• All other conditions are and combined.

Kind regards,
Torsten