From 8af9799e393b03eb655acff6daa20a66e4512945 Mon Sep 17 00:00:00 2001 From: Neha Devarapalli Date: Fri, 7 Aug 2026 09:42:33 -0700 Subject: [PATCH 1/2] docs(ngts): clarify tsg_id may be a sub-TSG --- README-NGTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-NGTS.md b/README-NGTS.md index c1c9768..fbac96b 100644 --- a/README-NGTS.md +++ b/README-NGTS.md @@ -87,7 +87,7 @@ conn = venafi_connection( |---|---|---| | `client_id` | yes¹ | Service-account Client ID used to obtain an access token. | | `client_secret` | yes¹ | Service-account Client Secret used to obtain an access token. | -| `tsg_id` | yes² | Tenant Service Group ID. Used to derive the OAuth scope as `tsg_id:`. | +| `tsg_id` | yes² | Tenant Service Group ID. Used to derive the OAuth scope as `tsg_id:` (may be a sub-TSG, not only the one the service account was created under, provided it's authorized for that scope). | | `scope` | yes² | OAuth scope (e.g. `tsg_id:`). Takes precedence over `tsg_id` when supplied. | | `access_token` | no¹ | A pre-issued OAuth access token. When supplied, `client_id`/`client_secret` become optional (but are still used to refresh the token if present). | | `token_url` | no | OAuth token endpoint. Defaults to the Palo Alto production endpoint (see below); override it for non-production environments. | From e4ec185e3d29d58f0a898121a1f2d7c0c829fbda Mon Sep 17 00:00:00 2001 From: Neha Devarapalli Date: Fri, 7 Aug 2026 11:12:41 -0700 Subject: [PATCH 2/2] docs(ngts): reword sub-TSG clarification for clarity --- README-NGTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README-NGTS.md b/README-NGTS.md index fbac96b..8007eb8 100644 --- a/README-NGTS.md +++ b/README-NGTS.md @@ -87,7 +87,7 @@ conn = venafi_connection( |---|---|---| | `client_id` | yes¹ | Service-account Client ID used to obtain an access token. | | `client_secret` | yes¹ | Service-account Client Secret used to obtain an access token. | -| `tsg_id` | yes² | Tenant Service Group ID. Used to derive the OAuth scope as `tsg_id:` (may be a sub-TSG, not only the one the service account was created under, provided it's authorized for that scope). | +| `tsg_id` | yes² | Tenant Service Group ID. Used to derive the OAuth scope as `tsg_id:`. Can be any TSG the service account is authorized for, including a sub-TSG — not just the TSG it was originally created under. | | `scope` | yes² | OAuth scope (e.g. `tsg_id:`). Takes precedence over `tsg_id` when supplied. | | `access_token` | no¹ | A pre-issued OAuth access token. When supplied, `client_id`/`client_secret` become optional (but are still used to refresh the token if present). | | `token_url` | no | OAuth token endpoint. Defaults to the Palo Alto production endpoint (see below); override it for non-production environments. |