Browser Bridge

Define a binding: which secret may be typed, and into which hosts. Humans only, behind a step-up — an agent that could create one could nominate any path it liked as fillable.

post/v1/browser/credentials

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/browser/credentials
  • Auth: HTTP bearer

Request body

labelstring required
vault_idstring uuid required

Must belong to the caller's org.

secret_pathstring required

Path of the secret inside that vault. The value never lands in the binding.

login_urlstring required

https only, and its host must be in allowed_hosts or sso_hosts — the bridge navigates here itself, one step before a password is typed.

allowed_hostsstring[] required

Hostnames. A bare entry matches only itself; a leading dot ('.example.com') matches that host and any subdomain. URLs, ports and '' are refused — '' has no meaning to the matcher, so it would be stored and then match nothing.

sso_hostsstring[]

Identity-provider hosts the login legitimately bounces through.

Response

Created. Every field is a pointer or a policy; none is secret.

Changes

No recorded changes to this operation across all 1 revision of this API.