COconductorone
Workload Federation

Create Provider

Changed on

CreateProvider registers a new external OIDC issuer for the tenant. Validates the issuer URL via OIDC discovery synchronously.

post/api/v1/workload_federation/providers

Request

  • Base URL
    https://example.conductor.one
  • URL
    https://example.conductor.one/api/v1/workload_federation/providers
  • Auth
    HTTP bearer and OAuth 2
    Client credentials
    Token URL: /auth/v1/token

Request body

descriptionstring

A description of what this provider is for.

displayNamestring

The display name for the new provider.

issuerUrlstring

The issuer URL. For OIDC providers, this is an HTTPS URL validated via OIDC discovery. For SPIFFE providers, this is the SPIFFE trust-domain URI (e.g., spiffe://prod.example.com). Normalized on write: lowercase scheme/host, no trailing slash. Unique within tenant.

oidcC1ApiWorkloadFederationV1OIDCSettings

OIDCSettings is the kind-specific configuration block for classic OIDC providers (GitHub Actions, GitLab CI, HCP Terraform, AWS IAM Outbound, any CUSTOM provider). Empty for now; future fields like custom_jwks_url, audience overrides, and required_claims land here.

wellKnownProvider'WELL_KNOWN_WORKLOAD_PROVIDER_UNSPECIFIED' | 'WELL_KNOWN_WORKLOAD_PROVIDER_CUSTOM' | 'WELL_KNOWN_WORKLOAD_PROVIDER_GITHUB_ACTIONS' | 'WELL_KNOWN_WORKLOAD_PROVIDER_GITLAB_CI' | 'WELL_KNOWN_WORKLOAD_PROVIDER_HCP_TERRAFORM' | 'WELL_KNOWN_WORKLOAD_PROVIDER_AWS_IAM_OUTBOUND' | 'WELL_KNOWN_WORKLOAD_PROVIDER_SPIFFE' | 'WELL_KNOWN_WORKLOAD_PROVIDER_C1_EDGE'

Well-known provider type. Required -- UNSPECIFIED is rejected. When set to a named source, the backend validates issuer_url consistency. SPIFFE wkp requires settings.spiffe; all other wkp values require settings.oidc.

Response

Successful response

Changes

  • 918a4e749f56Revision changes
    • warning

      added the new WELL_KNOWN_WORKLOAD_PROVIDER_C1_EDGE enum value to the // response property for the response status

    • info

      added the new WELL_KNOWN_WORKLOAD_PROVIDER_C1_EDGE enum value to the request property

    • info

      added the optional property // to the response with the status

  • f2cf3228f366Revision changes
    • breaking

      the request property became not nullable

    • breaking

      the request property became not nullable

    • breaking

      the request property type changed from object to no type

    • breaking

      the request property type changed from object to no type

    • breaking

      added subschema #2 to the response property oneOf list for the response status

    • breaking

      the response's property type changed from object to no type for status

    • warning

      removed the request property /

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • info

      added subschema #2 to the request property oneOf list

    • info

      added subschema #2 to the request property oneOf list