keys

Create Federation Rule

Changed on

Let an OpenID Connect identity token authenticate as this key, in place of its secret.

The issuer must be one of the deployment's federation_issuers, else 400. A token authenticates when it is signed by that issuer, its aud contains audience, and it carries the rule's subject and verified email, whichever the rule sets. A rule naming the identity of an existing rule answers 409: the same issuer, audience, subject and email on this key, or on another key the same issuer and audience with a subject or email in common and no contradicting value.

post/api/v1/keys/{key_id}/federation-rules

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header Otari-Key
    • API key in header x-api-key

Path parameters

key_idstring required

Request body

audiencestring required

A value the token's 'aud' must contain.

emailstring nullable

The token's verified 'email', when the rule names one. Compared without regard to case.

issuerstring required

The token's 'iss', one of the deployment's federation_issuers.

subjectstring nullable

The token's 'sub', when the rule names one.

Example request

{
  "audience": "https://otari.example.com",
  "email": "hackbot-api@my-project.iam.gserviceaccount.com",
  "issuer": "https://accounts.google.com"
}

Response

Successful Response

api_key_idstring required
audiencestring required
created_atstring date-time required
emailstring nullable required
idstring required
issuerstring required
subjectstring nullable required

Changes