---
title: "Create a GitHub cloud auth intake mapping"
method: POST
path: "/api/v2/wif/github/intake_mapping"
tags: ["Cloud Authentication"]
---

# Create a GitHub cloud auth intake mapping

`POST /api/v2/wif/github/intake_mapping`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/wif/github/intake_mapping`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/wif/github/intake_mapping/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a GitHub cloud authentication intake mapping. This endpoint entitles a matching GitHub Actions OIDC principal to request Datadog API keys.

## Request body

- GitHubCloudAuthIntakeMappingCreateRequest: Request used to create a GitHub cloud authentication intake mapping.
  - `data` GitHubCloudAuthIntakeMappingCreateData, required: Data for creating a GitHub cloud authentication intake mapping.
    - `attributes` GitHubCloudAuthIntakeMappingCreateAttributes, required: Attributes for creating a GitHub cloud authentication intake mapping
      - `claim_matchers` GitHubOIDCClaimPatterns, required: GitHub Actions OIDC claims to match against. Each field is a regular expression. The `sub` claim is required; all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
        - `actor` string: Regular expression matched against the `actor` claim.
        - `actor_id` string: Regular expression matched against the `actor_id` claim.
        - `enterprise` string: Regular expression matched against the `enterprise` claim.
        - `enterprise_id` string: Regular expression matched against the `enterprise_id` claim.
        - `environment` string: Regular expression matched against the `environment` claim.
        - `event_name` string: Regular expression matched against the `event_name` claim.
        - `job_workflow_ref` string: Regular expression matched against the `job_workflow_ref` claim.
        - `ref` string: Regular expression matched against the `ref` claim.
        - `ref_type` string: Regular expression matched against the `ref_type` claim.
        - `repository` string: Regular expression matched against the `repository` claim.
        - `repository_id` string: Regular expression matched against the `repository_id` claim.
        - `repository_owner` string: Regular expression matched against the `repository_owner` claim.
        - `repository_owner_id` string: Regular expression matched against the `repository_owner_id` claim.
        - `repository_visibility` string: Regular expression matched against the `repository_visibility` claim.
        - `runner_environment` string: Regular expression matched against the `runner_environment` claim.
        - `sub` string, required: Regular expression matched against the entire `sub` (subject) claim, the primary GitHub Actions OIDC identifier (for example, `repo:<OWNER>/<REPO>:ref:refs/heads/main`). The pattern must begin with `repo:<OWNER>/`, where `<OWNER>` is a literal repository-owner name rather than a regular expression.
        - `workflow` string: Regular expression matched against the `workflow` claim.
        - `workflow_ref` string: Regular expression matched against the `workflow_ref` claim.
    - `type` 'github_oidc_auth_intake_mapping', required: Type identifier for GitHub cloud authentication intake mapping.

## Response `201`

Created

- GitHubCloudAuthIntakeMappingResponse: Response containing a single GitHub cloud authentication intake mapping.
  - `data` GitHubCloudAuthIntakeMappingDataResponse, required: Data for GitHub cloud authentication intake mapping response.
    - `attributes` GitHubCloudAuthIntakeMappingAttributesResponse, required: Attributes for GitHub cloud authentication intake mapping response.
      - `claim_matchers` GitHubOIDCClaimPatterns, required: GitHub Actions OIDC claims to match against. Each field is a regular expression. The `sub` claim is required; all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics).
        - `actor` string: Regular expression matched against the `actor` claim.
        - `actor_id` string: Regular expression matched against the `actor_id` claim.
        - `enterprise` string: Regular expression matched against the `enterprise` claim.
        - `enterprise_id` string: Regular expression matched against the `enterprise_id` claim.
        - `environment` string: Regular expression matched against the `environment` claim.
        - `event_name` string: Regular expression matched against the `event_name` claim.
        - `job_workflow_ref` string: Regular expression matched against the `job_workflow_ref` claim.
        - `ref` string: Regular expression matched against the `ref` claim.
        - `ref_type` string: Regular expression matched against the `ref_type` claim.
        - `repository` string: Regular expression matched against the `repository` claim.
        - `repository_id` string: Regular expression matched against the `repository_id` claim.
        - `repository_owner` string: Regular expression matched against the `repository_owner` claim.
        - `repository_owner_id` string: Regular expression matched against the `repository_owner_id` claim.
        - `repository_visibility` string: Regular expression matched against the `repository_visibility` claim.
        - `runner_environment` string: Regular expression matched against the `runner_environment` claim.
        - `sub` string, required: Regular expression matched against the entire `sub` (subject) claim, the primary GitHub Actions OIDC identifier (for example, `repo:<OWNER>/<REPO>:ref:refs/heads/main`). The pattern must begin with `repo:<OWNER>/`, where `<OWNER>` is a literal repository-owner name rather than a regular expression.
        - `workflow` string: Regular expression matched against the `workflow` claim.
        - `workflow_ref` string: Regular expression matched against the `workflow_ref` claim.
    - `id` string, required: Unique identifier for the intake mapping.
    - `type` 'github_oidc_auth_intake_mapping', required: Type identifier for GitHub cloud authentication intake mapping.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)